T1552.004: Private Keys
| View on MITRE ATT&CK | T1552.004 |
|---|---|
| Tactic(s) | Credential Access |
| Associated CAPEC Patterns | Signature Spoofing by Key Recreation (CAPEC-485) , Retrieve Embedded Sensitive Data (CAPEC-37) , Probe System Files (CAPEC-639) , Signature Spoofing by Key Theft (CAPEC-474) |
Data from MITRE ATT&CK®:
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.
Adversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows. Adversary tools may also search compromised systems for file extensions relating to cryptographic keys and certificates.(Citation: Kaspersky Careto)(Citation: Palo Alto Prince of Persia)
When a device is registered to Azure AD, a device key and a transport key are generated and used to verify the device’s identity.(Citation: Microsoft Primary Refresh Token) An adversary with access to the device may be able to export the keys in order to impersonate the device.(Citation: AADInternals Azure AD Device Identities)
On network devices, private keys may be exported via Network Device CLI commands such as crypto pki export.(Citation: cisco_deploy_rsa_keys)
Some private keys require a password or passphrase for operation, so an adversary may also use Input Capture for keylogging or attempt to Brute Force the passphrase off-line. These private keys can be used to authenticate to Remote Services like SSH or for use in decrypting other collected files such as email.
© 2024 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Cyber Threat Graph Context
Explore how this ATT&CK Technique relates to the wider threat graph
Reporting on this Technique
Scattered Spider Advisory AA23-320A
This advisory from CISA outlines tactics, techniques and procedures used by the Scattered Spider threat actors, as observed by the FBI up until ...
PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
Following an initial advisory issued in May 2023, this advisory from CISA, NSA and partners outlines information on the broader campaign of cyber ...
Mitigations for this technique
MITRE ATT&CK Mitigations
Encrypt Sensitive Information
Protect sensitive information with strong encryption.Password Policies
Set and enforce secure password policies for accounts.Restrict File and Directory Permissions
Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.Audit
Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.How to detect this technique
MITRE ATT&CK Data Components
Command Execution (Command)
The execution of a line of text, potentially with arguments, created from program code (e.g. a cmdlet executed via powershell.exe, interactive commands like >dir, shell executions, etc. )File Access (File)
Opening a file, which makes the file contents available to the requestor (ex: Windows EID 4663)Control Validation Tests for this Technique
Use Atomic Red Team tests to test your defenses against this technique.
Private Keys
Export Root Certificate with Export-Certificate
Copy Private SSH Keys with CP (freebsd)
Export Certificates with Mimikatz
Copy the users GnuPG directory with rsync
Discover Private SSH Keys
Export Root Certificate with Export-PFXCertificate
Copy Private SSH Keys with CP
ADFS token signing and encryption certificates theft - Remote
Copy the users GnuPG directory with rsync (freebsd)
ADFS token signing and encryption certificates theft - Local
CertUtil ExportPFX
Copy Private SSH Keys with rsync (freebsd)
Copy Private SSH Keys with rsync
Sigma Detections for this Technique
Suspicious PFX File Creation
Cisco Crypto Commands
Certificate Exported Via PowerShell - ScriptBlock
Private Keys Reconnaissance Via CommandLine Tools
PowerShell Get-Process LSASS
Certificate Exported Via PowerShell
SP800-53 Controls
See which controls can help protect against this MITRE ATT&CK technique. This is based on mappings to associated SP800-53 controls produced by the MITRE Engenuity Center for Threat-Informed Defense.