TA0042 · RESOURCE DEVELOPMENT
Digital Certificates
Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust.
Detect it with
Consider use of services that may aid in the tracking of newly issued certificates and/or certificates in use on sites across the Internet. In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.
Why it matters on shift
Digital Certificates is one of the concrete ways adversaries achieve resource development. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After resource development, the next tactic is usually Initial Access. Search your telemetry for the transition before closing the ticket.
Kill-chain context