UNC3886G1048 ↗
Has deployed malware using the victim's legitimate TLS certificate obtained from a compromised FortiGate device.1
tfMITRE ATT&CK sub-technique
Digital Certificates T1588.004
sub-technique of T1588 Obtain Capabilities
- Tactic
- Resource Development
- Platform
- PRE
- Version
- 1.2
- Created
- 01 October 2020
- Last modified
- 24 October 2025
Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
7
Threat groupsTop 23%
Threat groups77th percentile · 77% of ATT&CK techniques have this many threat groups attributed or fewer.3
CampaignsTop 12%
Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.Digital Certificates MITRE reference T1588.004
Top 23%of all ATT&CK techniques for number of groups
7 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Sea TurtleG1041 ↗
Created new certificates using a technique called the actors performed "certificate impersonation," a technique in which Sea Turtle obtained a certificate authority-signed X.509 certificate from another provider for the same domain imitating the one already used by the targeted organization.12
LuminousMothG1014 ↗
Has used a valid digital certificate for some of their malware.1
Mustang PandaG0129 ↗
Silent LibrarianG0122 ↗
Has obtained free Let's Encrypt SSL certificates for use on their phishing pages.12
BlackTechG0098 ↗
Has used valid, stolen digital certificates for some of their malware and tools.1
All 7 groups for this technique · 6 newest in this preview
3 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
RedDelta Modified PlugX Infection Chain OperationsC0047 ↗
Mustang Panda acquired Cloudflare Origin CA TLS certificates during RedDelta Modified PlugX Infection Chain Operations.1
Indian Critical Infrastructure IntrusionsC0043 ↗
Included the use of digital certificates spoofing Microsoft.1
Operation HoneybeeC0006 ↗
For Operation Honeybee, the threat actors stole a digital signature from Adobe Systems to use with their MaoCheng dropper.1
All 3 campaigns for this technique
Offense vs defense T1588.004
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1
first rule: 2025 Q2 · 2 of 3 campaigns plotted (Operation Honeybee (dated 2017) falls before the 2022 window)Digital Certificates detection strategy DET0848
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Digital Certificates
1 platform
AN1980 · PRE
Consider use of services that may aid in the tracking of newly issued certificates and/or certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure. Some server-side components of adversary tools may have default values set for SSL/TLS certificates. Monitor for logged network traffic in response to a scan showing both protocol header and body values that may buy and/or steal SSL/TLS certificates that can be used during targeting. Detection efforts may be focused on related behaviors, such as Web Protocols, Asymmetric Cryptography, and/or Install Root Certificate.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Certificate RegistrationDC0093 | Certificate | None |
| Response ContentDC0104 | Internet Scan | None |
Pre-compromiseM1056
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.