{"id":"T1588.004","name":"Digital Certificates","url":"https://attack.mitre.org/techniques/T1588/004","tactics":["resource-development"],"platforms":["PRE"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0848","stix_id":"x-mitre-detection-strategy--4cadb231-5487-4135-834b-d0db75a93a45","name":"Detection of Digital Certificates","url":"https://attack.mitre.org/detectionstrategies/DET0848","analytics":[{"id":"AN1980","stix_id":"x-mitre-analytic--babb8a91-12af-4f2d-be59-2df099acc06c","name":"Analytic 1980","description":"Consider use of services that may aid in the tracking of newly issued certificates and/or certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.(Citation: Splunk Kovar Certificates 2017) Some server-side components of adversary tools may have default values set for SSL/TLS certificates.(Citation: Recorded Future Beacon Certificates)\nMonitor for logged network traffic in response to a scan showing both protocol header and body values that may buy and/or steal SSL/TLS certificates that can be used during targeting. Detection efforts may be focused on related behaviors, such as [Web Protocols](https://attack.mitre.org/techniques/T1071/001), [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002), and/or [Install Root Certificate](https://attack.mitre.org/techniques/T1553/004).","url":"https://attack.mitre.org/detectionstrategies/DET0848#AN1980","platforms":["PRE"],"log_source_references":[{"name":"Certificate","channel":"None","data_component":"DC0093","data_component_name":"Certificate Registration","log_source_slug":"certificate"},{"name":"Internet Scan","channel":"None","data_component":"DC0104","data_component_name":"Response Content","log_source_slug":"internet-scan"}],"mutable_elements":[],"live":true,"detection_strategies":["DET0848"],"techniques":["T1588.004"]}],"live":true,"version":"1.0","techniques":["T1588.004"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}