Skip to content

Private Keys

Subtechnique · ATTACK:enterprise:T1552.004

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1552.004",
  "title": "Private Keys",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1552/004",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--60b508a1-6a5e-46b1-821a-9f7b78752abf",
  "external_id": "T1552.004",
  "domain": "enterprise",
  "created": "2020-02-04T13:06:49.258Z",
  "modified": "2026-05-12T15:12:00.635Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "Palo Alto Prince of Persia",
      "url": "https://researchcenter.paloaltonetworks.com/2016/06/unit42-prince-of-persia-game-over/"
    },
    {
      "source_name": "cisco_deploy_rsa_keys",
      "url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_pki/configuration/xe-17/sec-pki-xe-17-book/sec-deploy-rsa-pki.html#GUID-1CB802D8-9DE3-447F-BECE-CF22F5E11436"
    },
    {
      "source_name": "AADInternals Azure AD Device Identities",
      "url": "https://aadinternals.com/post/deviceidentity/"
    },
    {
      "source_name": "Kaspersky Careto",
      "url": "https://web.archive.org/web/20141031134104/http://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/unveilingthemask_v1.0.pdf"
    },
    {
      "source_name": "Microsoft Primary Refresh Token",
      "url": "https://learn.microsoft.com/en-us/azure/active-directory/devices/concept-primary-refresh-token"
    },
    {
      "source_name": "Wikipedia Public Key Crypto",
      "url": "https://en.wikipedia.org/wiki/Public-key_cryptography"
    }
  ]
}

Explicit source assertions (30)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:T1552.004 → subtechnique-of → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0be618a0-f752-450f-8838-60c17fabd278

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14adcf50-912a-48d5-87f6-72d2273039aa

ESET Machete July 2019

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c5b8ff2-400a-4e0f-a819-3cc8f1bc76b8

Adsecurity Mimikatz Guide

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d2ee595-1972-46ac-bd85-322bdc5e35de

FoxIT Wocao December 2019

ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f399069-fdf0-4326-b638-d5f7a5043c8f

FBI TeamPCP JUL 2026 · Wiz Trivy Compromise MAR 2026 · Palo Alto TeamPCP MAR 2026

ATTACK:enterprise:S0599 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--255347ba-c359-4a79-af44-089a502c6e9b

Aqua Kinsing April 2020

ATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c50e260-05dd-4bb3-9d75-5a84e2757fa7

Unit 42 Hildegard Malware

ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d3a898c-bdc3-4cc1-ae14-325dbb60f2e2

ATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--373f2bc5-e221-459e-9922-27bead9a53fe

SentinelLabs Metador Sept 2022

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a05b5c4-3810-4f0e-925e-04f02a6da511

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47c4478d-1526-4c4f-8158-17ad8cfcc6b9

cisco_deploy_rsa_keys

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54e92c5b-28d0-4506-8d8c-bb582d8b7172

Aryaka Kimsuky July 2025

ATTACK:enterprise:S1196 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61ccf81a-471a-4ab4-aee7-de3a3084f211

S2W Troll Stealer 2024 · Symantec Troll Stealer 2024

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6934c7b5-96ce-4265-aea3-7eae018d7f3c

Microsoft 365 Defender Solorigate · Cybersecurity Advisory SVR TTP May 2021

ATTACK:enterprise:S0661 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b2e4ea0-1d04-4cf5-8ca8-72b311e20737

MSTIC FoggyWeb September 2021

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6bbd0299-4e8b-4d31-83c4-c690e43294c0

Cado Security TeamTNT Worm August 2020 · Trend Micro TeamTNT

ATTACK:enterprise:S9042 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95d62fe0-1417-41ff-a9ba-66154959e93e

Aikido CanisterWorm MAR 2026

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9741bd7b-a3f2-4052-b2e0-f0fcf331ceae

Github PowerShell Empire

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5bea568-25fa-40b7-8ad0-1e30ebec57fc

Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bdf68d86-fce4-46ad-9421-afdaf14273fe

AADInternals Documentation

ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dabf635b-40fd-45e1-b7b8-ed6de9d1bf22

Microsoft Storm-0501 Embargo Ransomware August 2025

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de8fefef-bfe7-4720-a443-66713a47b439

Anomali Rocke March 2019

ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2772353-e6f8-406e-8416-fa4edeecd218

ESET Ebury Feb 2014

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed609ca1-8646-4827-9d1a-aad365de95f6

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee20a5f0-9386-41e8-ab4c-ab77b69761dc

AI-Mexico-Govt-Breach

ATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee382a02-cde0-49a8-89e2-26237a25740c

Microsoft Primary Refresh Token

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f27818f1-c9f8-4ed4-8fef-9217e0dfe49b

Flashpoint Mini Shai-Hulud MAY 2026 · Hunt.io TeamPCP Toolkit MAY 2026 · Trend Micro TeamPCP MAY 2026

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa0f9d88-17b4-4ff2-974e-2d12063646b7

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fca4d85e-fb7b-4a71-ac47-68ea189b0932

Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe720085-2a43-4f72-8a5f-cf6ae82f7127

Kaspersky Adwind Feb 2016

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.