GitHub Repo

Atomic Red Team

Date: 2023-02-01 ID: 43136df7-63f7-46d5-97af-a18d2a5f9e74 Author: Michael Haag Environment: attack_range Directory: atomic_red_team

Description

Generation of Atomic Red Team techniques that create and export a certificate on Windows, simulating an adversary stealing certificates.

MITRE ATT&CK Techniques

ID Technique Tactic
T1649 Steal or Forge Authentication Certificates Credential Access

Environment Details

Field Value
Environment attack_range
Directory atomic_red_team
Test Date 2023-02-01

Datasets

The following datasets were collected during this attack simulation:

Export_certificate_windows-Sysmon

  • Path: /datasets/attack_techniques/T1649/atomic_red_team/export_certificate_windows-sysmon.log
  • Sourcetype: XmlWinEventLog
  • Source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

Certwrite_windows-Sysmon

  • Path: /datasets/attack_techniques/T1649/atomic_red_team/certwrite_windows-sysmon.log
  • Sourcetype: XmlWinEventLog
  • Source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

4876_windows-Security

  • Path: /datasets/attack_techniques/T1649/atomic_red_team/4876_windows-security.log
  • Sourcetype: XmlWinEventLog
  • Source: XmlWinEventLog:Security

Export_pfxcertificate_windows-Sysmon

  • Path: /datasets/attack_techniques/T1649/atomic_red_team/export_pfxcertificate_windows-sysmon.log
  • Sourcetype: XmlWinEventLog
  • Source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

4104_export_pfx-Windows-Powershell

  • Path: /datasets/attack_techniques/T1649/atomic_red_team/4104_export_pfx-windows-powershell.log
  • Sourcetype: XmlWinEventLog
  • Source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational

Backupdb_certutil_windows-Sysmon

  • Path: /datasets/attack_techniques/T1649/atomic_red_team/backupdb_certutil_windows-sysmon.log
  • Sourcetype: XmlWinEventLog
  • Source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

4887_windows-Security

  • Path: /datasets/attack_techniques/T1649/atomic_red_team/4887_windows-security.log
  • Sourcetype: XmlWinEventLog
  • Source: XmlWinEventLog:Security

4886_windows-Security

  • Path: /datasets/attack_techniques/T1649/atomic_red_team/4886_windows-security.log
  • Sourcetype: XmlWinEventLog
  • Source: XmlWinEventLog:Security

4688_certutil_backupdb-Windows-Security

  • Path: /datasets/attack_techniques/T1649/atomic_red_team/4688_certutil_backupdb-windows-security.log
  • Sourcetype: XmlWinEventLog
  • Source: XmlWinEventLog:Security

The following detections in our security content repository use this attack data for testing:

Detection Name Type Source MITRE ATT&CK Analytic Story
Steal or Forge Authentication Certificates Behavior Identified Correlation Endpoint T1649 Windows Certificate Services
Windows PowerShell Export Certificate Anomaly Endpoint T1552.004, T1649 Windows Certificate Services
Windows Steal Authentication Certificates Export Certificate Anomaly Endpoint T1649 Windows Certificate Services
Windows Steal Authentication Certificates Export PfxCertificate Anomaly Endpoint T1649 Windows Certificate Services
Windows PowerShell Export PfxCertificate Anomaly Endpoint T1552.004, T1649 Scattered Lapsus$ Hunters, Windows Certificate Services, Water Gamayun
Windows Steal Authentication Certificates CryptoAPI Anomaly Endpoint T1649 Windows Certificate Services, Hellcat Ransomware
Windows Export Certificate Anomaly Endpoint T1552.004, T1649 Windows Certificate Services
Windows Steal Authentication Certificates CS Backup Anomaly Endpoint T1649 Windows Certificate Services
Windows Steal Authentication Certificates CertUtil Backup Anomaly Endpoint T1649 Windows Certificate Services, Storm-2460 CLFS Zero Day Exploitation
Windows Mimikatz Crypto Export File Extensions Anomaly Endpoint T1649 Sandworm Tools, CISA AA23-347A, Windows Certificate Services
Windows Steal Authentication Certificates Certificate Request Anomaly Endpoint T1649 Windows Certificate Services
Windows Steal Authentication Certificates Certificate Issued Anomaly Endpoint T1649 Windows Certificate Services

Usage Instructions

Replay with Splunk Attack Data

Replay attack data with replay.py from Splunk Attack Data.

1python replay.py --dataset /datasets/attack_techniques/T1649/atomic_red_team/export_certificate_windows-sysmon.log --index attack_data

Manual Import

  1. Download the dataset files from the paths listed above
  2. Configure your Splunk instance with the appropriate sourcetypes
  3. Import the logs using the Splunk Add Data wizard

Related Content

Find more detections and analytics for this attack technique in our security content repository.

Source: GitHub | Version: 1.0