MITRE D3FENDdefensive technique
D3-CA Certificate Analysis
- Tactic
- Detect
Definition
Analyzing Public Key Infrastructure certificates to detect if they have been misconfigured or spoofed using both network traffic, certificate fields and third-party logs.
How it works
How it works
Certificate Analysis ensures that the data elements of the certificate are current and anchored in a known trust model. Certificate authorities, revocation lists, and third-party secure logs are used in the analysis. Analysis includes detection of server impersonation, phishing domains, and forged certificates.
TLS certificates are designed to expire to ensure that the cryptographic keys are forced to be changed on a regular basis. The certificates in the trust path also expire and can cause a break in the trust chain. This means that even if a server certificate is updated correctly, intermediate certificates can expire and the trust chain is not maintained. This can cause services to become unavailable.
Related
Counters · MITRE ATT&CK (8)
- T1649 Steal or Forge Authentication Certificates technique
- T1573 Encrypted Channel technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
- T1071.001 Web Protocols sub-technique
- T1041 Exfiltration Over C2 Channel technique
- T1048 Exfiltration Over Alternative Protocol technique
- T1071 Application Layer Protocol technique
Child of · MITRE D3FEND (1)
- D3-NTA Network Traffic Analysis defensive technique