Steal or Forge Authentication Certificates
Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts.(Citation: O365 Blog Azure AD Device IDs)(Citation: Microsoft AD CS Overview) Auth...
BY SOURCE
PROCEDURES (22)
Auto-extracted: 2 detections for general monitoring
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for event log
Auto-extracted: 2 detections for impersonat
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for process creation monitoring
Auto-extracted: 1 detections for command line monitoring
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for mimikatz
Auto-extracted: 1 detections for mimikatz
Auto-extracted: 1 detections for script block
Auto-extracted: 1 detections for script block
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for mimikatz
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for command line monitoring
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for authentication monitoring
Auto-extracted: 1 detections for credential