T1649: Steal or Forge Authentication Certificates
Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts.[1][2]
Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files)[3], misplaced certificate files (i.e. Unsecured Credentials), or directly from the Windows certificate store via various crypto APIs.[4][5][6] With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Of note, the certificate’s extended key usage (EKU) values define signing, encryption, and authentication use cases, while the certificate’s subject alternative name (SAN) values define the certificate owner’s alternate names.[7]
Abusing certificates for authentication credentials may enable other behaviors such as Lateral Movement. Certificate-related misconfigurations may also enable opportunities for Privilege Escalation, by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable Persistence via stealing or forging certificates that can be used as Valid Accounts for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts.
Adversaries who have access to root (or subordinate) CA certificate private keys (or mechanisms protecting/managing these keys) may also establish Persistence by forging arbitrary authentication certificates for the victim domain (known as “golden” certificates).[7] Adversaries may also target certificates and related services in order to access other forms of credentials, such as Golden Ticket ticket-granting tickets (TGT) or NTLM plaintext.[7]
Analyst context for executives and security teams
Stealing or forging authentication certificates matters because certificates can function like passwords for users, devices, and machine accounts across Windows, Linux, macOS, and identity provider environments. If abused, they may allow access that survives password resets for the life of the certificate and can support lateral movement, privilege escalation, or persistence when certificate authority or enrollment controls are weak.
Executive priority
Treat certificate-based authentication as a credential and identity governance risk, not just a PKI administration issue. Leaders should ask whether AD CS, Entra ID device certificates, certificate stores, enrollment rights, and certificate authority private keys are inventoried, audited, and reviewed with the same rigor as privileged accounts. This technique is especially important for incident response readiness because password rotation alone may not remove access if valid or forged certificates remain usable.
Technical view
SOC, detection engineering, IAM, and IR teams should validate visibility across certificate storage, certificate enrollment and renewal, AD CS configuration, identity provider device certificates, and authentication events using certificates. ATT&CK does not provide official detection text for T1649, but the relationship to DET0240 indicates a detection strategy exists. Defenders should focus on evidence of unusual certificate requests, certificate store access, unexpected certificate files, changes to certificate templates or enrollment permissions, certificates with authentication-capable EKUs, suspicious SAN values, and use of certificates by user or machine accounts inconsistent with normal behavior. Relationship context also maps use by APT29 and software such as Mimikatz and AADInternals, so detections should consider credential-access tooling context without assuming every certificate event is malicious.
Likely telemetry
- Windows certificate store access and export activity
- Registry and file activity involving stored certificates or misplaced certificate files
- AD CS certificate authority, template, enrollment, renewal, and permission audit logs
- Identity provider and Entra ID device certificate or device identity events
- Authentication logs showing certificate-based access by user or machine accounts
Detection direction
- Confirm whether certificate authority and certificate template auditing is enabled and retained long enough for investigations.
- Baseline normal certificate enrollment and renewal patterns for users and machines, then alert on unusual subjects, SANs, EKUs, request volume, or privileged identity association.
- Correlate certificate-based authentication with account, device, and source context to identify access that continues after password resets or account recovery actions.
- Monitor for access to certificate stores, exported private keys, and certificate files, while tuning for legitimate administrative, backup, and certificate lifecycle operations.
- Review events involving tools mapped in ATT&CK relationships, such as Mimikatz and AADInternals, as supporting context rather than as the only detection path.
Mitigation priorities
- Harden Active Directory and AD CS configuration, including certificate templates, enrollment permissions, and privileged CA administration paths, aligning with the mapped Active Directory Configuration mitigation.
- Protect certificate private keys and sensitive certificate material at rest and in transit, consistent with the mapped Encrypt Sensitive Information mitigation.
- Disable or remove unnecessary certificate services, templates, enrollment options, or features that are not required for business operations, consistent with the mapped Disable or Remove Feature or Program mitigation.
- Implement regular auditing of certificate authority configuration, template permissions, enrollment activity, and certificate-based authentication, consistent with the mapped Audit mitigation.
- During incident response, include certificate revocation, CA/key trust review, device certificate review, and machine-account certificate checks in addition to password resets.
Analyst notes and limits
The supplied ATT&CK object places this technique in Credential Access and explicitly connects certificate abuse to possible lateral movement, privilege escalation, persistence, Valid Accounts behavior, and access to other credential forms. The most material business risk is that certificates may be overlooked during identity recovery and may remain valid after conventional password remediation.
Official ATT&CK detection guidance is not provided in the supplied object, and the related DET0240 details are not included beyond its existence. Local PKI design, AD CS deployment, identity provider configuration, logging depth, certificate lifetimes, and enrollment workflows are required to assess actual exposure and detection quality.
Steal or Forge Authentication Certificates
Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts.[1][2]
Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files)[3], misplaced certificate files (i.e. Unsecured Credentials), or directly from the Windows certificate store via various crypto APIs.[4][5][6] With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Of note, the certificate’s extended key usage (EKU) values define signing, encryption, and authentication use cases, while the certificate’s subject alternative name (SAN) values define the certificate owner’s alternate names.[7]
Abusing certificates for authentication credentials may enable other behaviors such as Lateral Movement. Certificate-related misconfigurations may also enable opportunities for Privilege Escalation, by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable Persistence via stealing or forging certificates that can be used as Valid Accounts for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts.
Adversaries who have access to root (or subordinate) CA certificate private keys (or mechanisms protecting/managing these keys) may also establish Persistence by forging arbitrary authentication certificates for the victim domain (known as “golden” certificates).[7] Adversaries may also target certificates and related services in order to access other forms of credentials, such as Golden Ticket ticket-granting tickets (TGT) or NTLM plaintext.[7]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Groups, software, and campaigns
G0016: APT29
APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).[1][2] They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.[3][4][5][6]
In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.[7][8] Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.[9][10][11][12][13][14]
S0677: AADInternals
AADInternals is a PowerShell-based framework for administering, enumerating, and exploiting Azure Active Directory. The tool is publicly available on GitHub.[1][2]
S0002: Mimikatz
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | 98f8087df481… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
O365 Blog Azure AD Device IDs
Syynimaa, N. (2022, February 15). Stealing and faking Azure AD device identities. Retrieved August 3, 2022.
Open source URL -
[2]
Microsoft AD CS Overview
Microsoft. (2016, August 31). Active Directory Certificate Services Overview. Retrieved August 2, 2022.
Open source URL -
[3]
APT29 Deep Look at Credential Roaming
Thibault Van Geluwe De Berlaere. (2022, November 8). They See Me Roaming: Following APT29 by Taking a Deeper Look at Windows Credential Roaming. Retrieved November 9, 2022.
Open source URL -
[4]
SpecterOps Certified Pre Owned
Schroeder, W. & Christensen, L. (2021, June 22). Certified Pre-Owned - Abusing Active Directory Certificate Services. Retrieved August 2, 2022.
Open source URL -
[5]
GitHub CertStealer
TheWover. (2021, April 21). CertStealer. Retrieved August 2, 2022.
Open source URL -
[6]
GitHub GhostPack Certificates
HarmJ0y. (2018, August 22). SharpDPAPI - Certificates. Retrieved August 2, 2022.
Open source URL -
[7]
Medium Certified Pre Owned
Schroeder, W. (2021, June 17). Certified Pre-Owned. Retrieved August 2, 2022.
Open source URL -
[8]
mitre-attack T1649Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.