Storm-0501G1053 ↗
Has utilized their own self-signed TLS certificate “Microsoft IT TLS CA 5” with their infrastructure.1
tfMITRE ATT&CK sub-technique
Digital Certificates T1587.003
sub-technique of T1587 Develop Capabilities
- Tactic
- Resource Development
- Platform
- PRE
- Version
- 1.2
- Created
- 01 October 2020
- Last modified
- 24 October 2025
Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA).
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.3
CampaignsTop 12%
Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.Digital Certificates MITRE reference T1587.003
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
PROMETHIUMG0056 ↗
Has created self-signed digital certificates for use in HTTPS C2 traffic.1
Gamaredon GroupG0047 ↗
Has used the same TLS certificate across its infrastructure.1
APT29G0016 ↗
Has created self-signed digital certificates to enable mutual TLS authentication for malware.12
All 4 groups for this technique
3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
ArcaneDoorC0046 ↗
Included acquiring digital certificates mimicking patterns associated with Cisco ASA appliances for command and control infrastructure.1
J-magic CampaignC0050 ↗
During the J-magic Campaign, threat actors used self-signed certificates on VPS C2 infrastructure.1
C0011C0011 ↗
For C0011, Transparent Tribe established SSL certificates on the typo-squatted domains the group registered.1
All 3 campaigns for this technique
Offense vs defense T1587.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 3Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1
first rule: 2022 Q4 · 3 of 3 campaigns plottedDigital Certificates detection strategy DET0844
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Digital Certificates
1 platform
AN1976 · PRE
Consider use of services that may aid in the tracking of certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure. Detection efforts may be focused on related behaviors, such as Web Protocols , Asymmetric Cryptography , and/or Install Root Certificate .
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Response ContentDC0104 | Internet Scan | None |
Pre-compromiseM1056
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.