Certificate Exported Via PowerShell - ScriptBlock

 1title: Certificate Exported Via PowerShell - ScriptBlock
 2id: aa7a3fce-bef5-4311-9cc1-5f04bb8c308c
 3related:
 4    - id: 9e716b33-63b2-46da-86a4-bd3c3b9b5dfb
 5      type: similar
 6status: test
 7description: Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.
 8references:
 9    - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a
10    - https://docs.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate
11    - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
12author: Florian Roth (Nextron Systems)
13date: 2021/04/23
14modified: 2023/05/18
15tags:
16    - attack.credential_access
17    - attack.t1552.004
18logsource:
19    product: windows
20    category: ps_script
21    definition: 'Requirements: Script Block Logging must be enabled'
22detection:
23    selection:
24        ScriptBlockText|contains:
25            - 'Export-PfxCertificate'
26            - 'Export-Certificate'
27    filter_optional_module_export:
28        ScriptBlockText|contains: 'CmdletsToExport = @('
29    condition: selection and not 1 of filter_optional_*
30falsepositives:
31    - Legitimate certificate exports by administrators. Additional filters might be required.
32level: medium

References

• CISA Identifies SUPERNOVA Malware During Incident Response | CISA

  From at least March 2020 through February 2021, the threat actor connected to the entity via the entity’s Pulse Secure VPN appliance (External Remote Services [T1133]). The threat actor connected v...

  
  Read More

• Export-PfxCertificate (pki)

  

  Use this topic to help manage Windows and Windows Server technologies with Windows PowerShell.

  
  Read More

• Breaking the Chain: Defending Against Certificate Services Abuse | Splunk

  

  Explore the common certificate abuses leveraged by current and relevant adversaries in the wild, the multiple methods they use to obtain certificates, how to gather relevant logs and ways to mitigate adversaries stealing certificates.

  
  Read More

Related rules

• PowerShell Get-Process LSASS
• HackTool - Dumpert Process Dumper Default File
• Suspicious Get-ADDBAccount Usage
• Abnormal LSASS Child and Parent Process Relationships (RedCanary Threat Detection Report)
• Abnormal LSASS Process Access and Injection (RedCanary Threat Detection Report)