CmdID

CmdID / Techniques

T1649 Steal or Forge Authentication Certificates

Adversaries may steal or forge certificates used for authentication to access remote systems or resources. MITRE ATT&CK

2 Sigma rules T1649 on attack.mitre.org

Sigma rules tagged with it

process creation, the highest levels first
highHackTool - Certify ExecutionpH-T (Nextron Systems) · Windows
highHackTool - Certipy ExecutionpH-T (Nextron Systems), Sittikorn Sangrattanapitak · Windows