T1649 — Steal or Forge Authentication Certificates

Tactic: Credential Access · Platforms: Windows, Linux, macOS, Identity Provider

Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active…

Sigma detection rules (4)

title: T1649 Steal or Forge Authentication Certificates
id: fb79dbcb-2695-4a74-9993-5e889e37a5f0
description: 'Detects Kerberos TGT requests (EventID 4768) that used PKINIT certificate-based pre-authentication (PreAuthType 16), narrowing from the prior all-TGT-requests logic to only certificate-backed logons, which is the telemetry surface relevant to stolen or forged AD CS/Entra ID authentication certificates. (Data Component: Active Directory Credential Request; baseline tier: windows-eventid.) Tune using: EKU_Thresholds, TimeWindow, LogonContext.'
references:
  - https://attack.mitre.org/techniques/T1649
author: Shahrukh Khan
date: 2026-01-12
license: MIT
tags:
  - attack.credential-access
  - attack.t1649

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: '4768'
    PreAuthType: '16'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate smart card / certificate-based logon (PKINIT) is common in orgs with CBA or hybrid Entra ID certificate auth enabled; baseline the set of accounts/hosts expected to use PKINIT before alerting broadly. System and service accounts are excluded via filter_system_account.

level: medium

title: T1649 Steal or Forge Authentication Certificates
id: be0d2982-9a72-4809-913c-485b66035891
description: 'Detection Strategy for Steal or Forge Authentication Certificates. (Retargeted to file_event auditd telemetry for X.509/authentication certificate and private key material only; the prior /root/.ssh/ path belongs to T1552.004 Unsecured Credentials: Private Keys and has been removed. Reads by the TLS-terminating service normally bound to a given cert/key path are excluded, since every service reads its own key on every start/reload; unexpected-process reads remain in scope.) Tune using: PathExclusions, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1649
author: Shahrukh Khan
date: 2026-05-30
license: MIT
tags:
  - attack.credential-access
  - attack.t1649

logsource:
  category: file_event
  product: linux

detection:
  selection_ext:
    type: PATH
    name|contains:
      - '.pem'
      - '.pfx'
      - '.p12'
      - '.key'
  selection_path:
    name|contains:
      - '/etc/ssl/private/'
      - '/etc/pki/'
  filter_expected_service:
    exe|endswith:
      - '/nginx'
      - '/httpd'
      - '/apache2'
      - '/haproxy'
      - '/stunnel'
      - '/openvpn'
  condition: selection_ext and selection_path and not filter_expected_service

falsepositives:
  - Certificate renewal/reload tooling (certbot, cert-manager agents) and one-off root/admin reads during rotation will also match; scope PathExclusions to the specific cert/key path's owning service and its renewal tool, and flag remaining UserContext as high-signal.

level: high

title: T1649 Steal or Forge Authentication Certificates
id: de126671-895c-472e-b093-d49c7989206f
description: 'Detection Strategy for Steal or Forge Authentication Certificates. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ApplicationAllowList.'
references:
  - https://attack.mitre.org/techniques/T1649
author: Shahrukh Khan
date: 2026-02-19
license: MIT
tags:
  - attack.credential-access
  - attack.t1649

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/security'
    CommandLine|contains|all:
      - 'export'
      - '-k'

  condition: selection

falsepositives:
  - IT staff or certificate management tools legitimately exporting a certificate and private key from the keychain for approved renewal or migration.

level: high

title: T1649 Steal or Forge Authentication Certificates
id: 805c3f37-c7b5-4533-aaee-57bf0a1c4f11
description: 'Detection Strategy for Steal or Forge Authentication Certificates. (Data Component: Active Directory Object Modification; baseline tier: fallback.) Tune using: GeoContext, Thresholds.'
references:
  - https://attack.mitre.org/techniques/T1649
author: Shahrukh Khan
date: 2026-04-25
license: MIT
tags:
  - attack.credential-access
  - attack.t1649

logsource:
  product: azure
  service: signinlogs

detection:
  selection:
    ResultType: '0'
    AppDisplayName|contains:
      - 'AAD Connect'
      - 'Directory Synchronization'
  selection_geo:
    ConditionalAccessStatus: 'notApplied'
  condition: selection and selection_geo

falsepositives:
  - Legitimate directory synchronization traffic from a newly provisioned or relocated hybrid identity server; a full geo-velocity check requires historical IP baselines not present in a single event.

level: high

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1649 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan