An analyst examines Zeek's x509.log and finds a certificate with an unusually short validity period of 24 hours issued by 'Let's Encrypt.' The certificate is for a domain registered 2 days ago. Why is this combination suspicious?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you're looking at a classic threat pattern: short-lived certificates on newly registered domains often mark disposable command-and-control infrastructure that rotates before reputation systems can block it. That combination is suspicious even though the certificate itself may be technically valid.
Full Explanation
Short-lived certificates for newly registered domains are frequently used by attackers for disposable command-and-control infrastructure that rotates frequently to evade reputation-based blocking. The combination of a new domain plus short certificate validity is a strong threat indicator. The claim that Let's Encrypt certificates are always untrusted because they are free is wrong because Let's Encrypt is a legitimate, browser-trusted CA; free does not mean untrusted. The claim that 24-hour certificates cause browser warnings about expiration is wrong because 24-hour validity only causes warnings after expiration, not before; the concern here is the attack pattern, not browser behavior. The claim that Zeek cannot correctly parse Let's Encrypt certificates, producing false alerts is wrong because Zeek parses standard X.509 certificates regardless of issuing CA.