Detect Digital Certificates in Microsoft Sentinel
Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust and include key information, owner identity, and a digital signature from a verifying entity. In the case of self-signing, these certificates lack third-party CA trust but remain functional for encrypting traffic. Adversaries create self-signed certificates to encrypt C2 communications (as seen with APT29/WellMess using mutual TLS authentication), to enable adversary-in-the-middle attacks if installed as a trusted root certificate, or to impersonate legitimate services. PROMETHIUM used self-signed certificates for HTTPS C2, Gamaredon Group reused the same TLS certificate across infrastructure clusters, and Storm-0501 spoofed a 'Microsoft IT TLS CA 5' self-signed certificate. Detection must focus on observable side-effects: certificate generation tool execution on compromised hosts, suspicious certificate store modifications, and network TLS connections bearing anomalous certificate properties.
MITRE ATT&CK
- Tactic
- Resource Development
- Technique
- T1587 Develop Capabilities
- Sub-technique
- T1587.003 Digital Certificates
- Canonical reference
- https://attack.mitre.org/techniques/T1587/003/
KQL Detection Query
// T1587.003 — Self-Signed Certificate Creation and Suspicious Certificate Operations
// Branch 1: Known certificate generation tool execution
let CertGenTools = dynamic(["openssl.exe", "openssl", "makecert.exe", "pvk2pfx.exe", "certmgr.exe"]);
let OpenSSLCertPatterns = dynamic(["req -new", "x509 -req", "genrsa", "genpkey", "pkcs12 -export", "-newkey rsa", "-newkey ec", "req -x509", "gencert", "-selfsign"]);
let CertToolExec = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (CertGenTools)
or (FileName =~ "openssl" and ProcessCommandLine has_any (OpenSSLCertPatterns))
| extend DetectionBranch = "CertGenToolExecution"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionBranch;
// Branch 2: PowerShell certificate creation via .NET or cmdlet
let PSCertPatterns = dynamic(["New-SelfSignedCertificate", "X509Certificate2", "System.Security.Cryptography.X509Certificates", "CertificateRequest", "RSACryptoServiceProvider", "ECDsaCng"]);
let PSCertCreate = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (PSCertPatterns)
| extend DetectionBranch = "PSCertificateCreation"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionBranch;
// Branch 3: certutil certificate import/store modification
let CertUtilImportPatterns = dynamic(["-addstore", "-addrepo", "-MergePFX", "-importpfx", "-p12", "-importcert"]);
let CertStorePaths = dynamic(["Root", "AuthRoot", "TrustedPublisher", "TrustedPeople", "CA"]);
let CertUtilOps = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "certutil.exe"
| where ProcessCommandLine has_any (CertUtilImportPatterns)
| extend TargetsRootStore = ProcessCommandLine has_any (CertStorePaths)
| extend DetectionBranch = "CertUtilStoreImport"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionBranch, TargetsRootStore;
// Branch 4: .pfx/.pem/.cer file creation in suspicious locations
let SuspiciousCertPaths = dynamic(["\\Temp\\", "\\AppData\\Local\\Temp\\", "\\Users\\Public\\", "\\ProgramData\\", "\\Windows\\Temp\\"]);
let CertFileCreate = DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName endswith ".pfx" or FileName endswith ".pem" or FileName endswith ".cer" or FileName endswith ".crt" or FileName endswith ".p12" or FileName endswith ".key"
| where FolderPath has_any (SuspiciousCertPaths)
| extend DetectionBranch = "SuspiciousCertFileCreation"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName = FileName,
ProcessCommandLine = InitiatingProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionBranch;
union CertToolExec, PSCertCreate, CertUtilOps, CertFileCreate
| sort by Timestamp descDetects observable indicators of self-signed certificate creation and suspicious certificate store operations using Microsoft Defender for Endpoint tables. Monitors four detection branches: (1) direct execution of certificate generation tools such as openssl and makecert; (2) PowerShell invocations of New-SelfSignedCertificate or .NET X509 certificate classes; (3) certutil.exe certificate import operations targeting the machine certificate store, with special focus on Root/AuthRoot store modifications; and (4) creation of certificate file types (.pfx, .pem, .cer, .p12, .key) in anomalous filesystem locations. Because T1587.003 is a pre-compromise preparation technique, the highest-confidence detection signals are certificate tools running on already-compromised hosts and unauthorized root certificate store modifications enabling adversary-in-the-middle.
Data Sources
Required Tables
False Positives & Tuning
- Development teams using openssl or New-SelfSignedCertificate to generate local development HTTPS certificates for localhost testing
- PKI administrators and IT operations staff managing internal certificate authority infrastructure and importing trusted root certificates from enterprise CAs
- DevOps pipelines (Jenkins, GitLab CI, GitHub Actions runners on Windows) that generate ephemeral self-signed certificates for containerized test environments
- Security penetration testers and red team operators running authorized exercises involving certificate-based C2 simulation
- Web server configuration scripts (IIS setup, Nginx automation) that auto-generate self-signed certificates during initial service configuration
- Monitoring and observability agents (Datadog, Elastic Agent) that manage their own TLS certificates for encrypted data shipping
Other platforms for T1587.003
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Create Self-Signed Certificate with PowerShell New-SelfSignedCertificate
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'New-SelfSignedCertificate' and the DnsName value. Sysmon Event ID 11: File Create event for df00tech-test-cert.pfx in %TEMP%. PowerShell ScriptBlock Log Event ID 4104 capturing the full certificate creation and export script. Registry Event ID 12/13 for the temporary certificate store entry under HKCU\SOFTWARE\Microsoft\SystemCertificates\My.
- Test 2Generate Self-Signed Certificate with OpenSSL
Expected signal: Sysmon Event ID 1: Two Process Create events — first for 'openssl req -x509' with -subj containing the spoofed Microsoft subject, second for 'openssl pkcs12 -export'. Sysmon Event IDs 11: File Create events for .key, .crt, and .pfx files in %TEMP%. The -subj value '/CN=Microsoft IT TLS CA 5' directly matches the Storm-0501 technique documented in ATT&CK.
- Test 3Import Self-Signed Certificate to Root Certificate Store
Expected signal: Sysmon Event ID 1: Process Create for certutil.exe with CommandLine '-addstore Root' and the .cer file path. Sysmon Event ID 12/13: Registry key creation under HKLM\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\<thumbprint>. Sysmon Event ID 11: File Create for the .cer export in %TEMP%. Security Event ID 4657 (if object access auditing enabled) for the registry write to the certificate store.
- Test 4Certificate Generation via OpenSSL on Linux
Expected signal: Linux auditd execve syscall records for each openssl invocation with full argument list. Syslog process execution entries for openssl. File creation events in /tmp for .pem and .pfx files. If Sysmon for Linux is deployed: Event ID 1 (Process Create) with Image=/usr/bin/openssl and full CommandLine capture including the spoofed -subj value.
References (10)
- https://attack.mitre.org/techniques/T1587/003/
- https://www.splunk.com/en_us/blog/security/tall-tales-of-hunting-with-tls-ssl-certificates.html
- https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf
- https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html
- https://www.mandiant.com/resources/blog/storm-0501-ransomware
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
- https://learn.microsoft.com/en-us/powershell/module/pki/new-selfsignedcertificate
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceregistryevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1587.003/T1587.003.md
Unlock Pro Content
Get the full detection package for T1587.003 including response playbook, investigation guide, and atomic red team tests.