Data Points

🔒 SSL/TLS Certificate

A digital certificate binding a public key to an identity.

Cyber

Sources

2 no-auth

Disciplines

that use it

Mission domains

reach

Workbench

open →

native tool

🔧 Native workbench

Open SSL/TLS Certificate workbench →Advanced search →Link analysis →

🔗 Analyst pivots

Search platform →OSINT pivot →Source catalog →

🔌 Sources that yield SSL/TLS Certificate (3)

Source	Category	Auth	Format
abuse.ch SSLBL JA3 Fingerprints Malicious TLS client JA3 fingerprint blocklist.	CERTINT	NONE	`csv`	home↗ api↗
crt.sh Certificate Transparency CT-log certificate discovery.	CERTINT	NONE	`json`	home↗ api↗
Censys Search (ASM) Internet-wide attack-surface scanning.	ASMINT	KEY	`json`	home↗ api↗

🧭 Disciplines

CERTINT (2) →ASMINT (1) →MALINT (1) →

🎯 Mission Domains

Cyber Crime (3) →Critical Infrastructure (2) →Malware (2) →Operational Security (1) →Supply Chain Security (1) →APT / Espionage (1) →

🔍 Lookup

🔄 Live Datasets & APIs (2 key-free · ingestible)

Dataset / API	Format	Endpoint
abuse.ch SSLBL JA3 Fingerprints	`csv`	https://sslbl.abuse.ch/blacklist/ja3_fingerprints.csv	collect
crt.sh Certificate Transparency	`json`	https://crt.sh/?output=json&q=	collect

Run Auto-Collect Datasets Hub Import

📜 Playbook — SSL/TLS Certificate exploitation

Direction — frame the requirement for SSL/TLS Certificate: what decision does this support, by when?
Collection — pull the 3 mapped sources (2 free) and the native workbench (open); capture provenance and observe OPSEC.
Processing — normalize, de-duplicate and enrich the collected data.
Analysis — correlate against local holdings; apply ACH; assign confidence.
Dissemination — open a case, draft a report, share via STIX/MISP.
Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief ⚡ AI Skills Resolve Enrich Auto-Collect Hunt Report Export

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Enrichment → local →Integrations →

🎫 SSL/TLS Certificate

An SSL/TLS certificate is an X.509 credential binding a public key to identity attributes (subject, SAN, issuer) and carrying a unique fingerprint and serial. It matters because certificate reuse, self-signed C2 certs, and JA3/JARM overlaps expose shared adversary infrastructure that survives IP and domain rotation.

Format: X.509 DER/PEM; SHA-1/SHA-256 fingerprint (40/64 hex); serial number (hex); CN/SAN dNSNames; JA3/JA3S/JARM fingerprints; SCT for CT logs.

📡 How it is collected

Internet-wide TLS scanning (Censys/Shodan)
Certificate Transparency log monitoring
Passive TLS capture from netflow/PCAP
Sandbox network capture of C2 handshakes
Pulling leaf/chain from live host on :443
EDR/proxy TLS metadata logging

📚 Enrichment & validation sources

crt.sh (CT logs) →Censys →Shodan →SSL Labs (Qualys) →Certificate Transparency (Google/Cloudflare logs) →JARM database (abuse.ch) →CertStream →Facebook CT Monitor →

🔗 Pivot to

dp_ip (hosting host) →dp_domain / SAN entries →dp_malware_family (C2 cert reuse) →dp_hash (signing / authentihash) →actor-profile / infrastructure →ASN / hosting provider →

🧩 Analysis & hunting techniques

Fingerprint reuse pivoting across hosts
JA3/JARM server-fingerprint clustering
SAN enumeration for related domains
CT-log monitoring for lookalike issuance
Self-signed / anomalous-issuer hunting
Certificate lifetime & validity-window analysis
Chain / CA trust-path validation
Cobalt Strike default-cert detection

🔧 Tools

OpenSSL
sslscan / testssl.sh
JARM (Salesforce)
Censys CLI
crt.sh queries
Zeek (x509 logs)
Nmap ssl-cert

⚡ Workbench actions

Fetch & parse certificate
Search CT logs (crt.sh)
Compute JA3/JARM
Pivot on fingerprint reuse
Enumerate SAN domains
Validate chain & issuer
Cluster by ASN/host
Flag self-signed / default C2 cert

📊 Dashboard KPIs

Hosts sharing fingerprintSAN domain countValidity window (days)Self-signed flagCT-log first-seen date

📂 Open

Data point →IP profile →Passive DNS →DNS audit →Correlate →

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook