T1649Credential Access
Steal or Forge Authentication Certificates
Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Entra ID device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
11 Sigma rules tagged T1649Steal or Forge Authentication CertificatesT164911 general rules
- DC Machine Account Network Logon from Non-DC Source IPcriticalexperimental
- HackTool - Certify Executionhightest
- HackTool - Certipy Executionhightest
- ADCS - Certighost CDC Chase Certificate Request (CVE-2026-54121)highexperimental
- ADCS - Certighost Certificate Issued via CDC Chase (CVE-2026-54121)highexperimental
- ADCS - Certighost Ghost Machine Account Creationhighexperimental
- Certificate Services Outbound SMB or LDAP Connectionhighexperimental
- DC Machine Account TGT Request from Non-DC Source IPhighexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Steal or Forge Authentication Certificates
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.