Analytics BIOC Low
✕

A suspicious process enrolled for a certificate

A suspicious process enrolled for a certificate.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Unsecured Credentials (T1552) Steal or Forge Authentication Certificates (T1649)
Detector tags: Active Directory Certificate Services Analytics
Attacker's goals:

Attackers may authenticate as users using a certificate. If a policy is configured with permissive options, the attacker can authenticate as a user with high privileges.

Investigative actions:

See whether this was a legitimate action. Follow process/user activities. Check for suspicious certificate authentications.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • An unsigned suspicious process enrolled for a certificate Medium (parent: Low)