Lion Cipher Lab
Pivot on TLS certificate fields and measure each pivot's precision
- Threat Intel Analyst
- Intermediate
- ~75 min
- Free · no account required
Why it matters
When an investigation hands you one malicious server, the question that matters next is 'what else does this operator run?' The TLS certificate on that server is one of the richest answers, because internet-wide scanners record every certificate they see, and operators are creatures of habit: they copy one certificate onto several servers, re-issue from the same key, or leave the default values their tooling filled in. MITRE ATT&CK says it directly in its detection guidance for self-signed certificates (T1587.003): it may be possible to pivot on known pieces of certificate information to…
What you'll learn
- Naming the pivotable fields of an X.509 certificate: fingerprint, SPKI, serial, issuer and subject DN, validity, SAN
- Minting self-signed certificates with the openssl CLI and recognising the defaults an operator leaves behind
- Hashing a certificate's public key (SPKI) with a small DER walker, and proving it against an openssl pipeline
- Measuring the precision and recall of each certificate pivot against labelled data
- Checking a key's prevalence before pivoting on it, so a CDN or appliance certificate does not flood the result
- Building a high-confidence core from a strong pivot, then using it to constrain a weak one
Steps in this lab
- The idea: one certificate, six pivots of very different strength
- The vocabulary: the fields of an X.509 certificate
- Set up a short, empty working folder and check your tools
- Mint three certificates the way a hurried operator does
- Read every pivot key with a stdlib Python reader
- The judgment: rank the fields before you trust any of them
- Generate a labelled, synthetic scan of 641 TLS services
- Pivot from three seeds and score every field
- Read the scores like an analyst
- The honest limits: what certificates cannot tell you
- Where this goes next