Certificate Exported Via PowerShell
Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.
Sigma rule (View on GitHub)
1title: Certificate Exported Via PowerShell
2id: 9e716b33-63b2-46da-86a4-bd3c3b9b5dfb
3related:
4 - id: aa7a3fce-bef5-4311-9cc1-5f04bb8c308c
5 type: similar
6status: test
7description: Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.
8references:
9 - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a
10 - https://docs.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate
11 - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
12author: Nasreddine Bencherchali (Nextron Systems)
13date: 2023/05/18
14tags:
15 - attack.credential_access
16 - attack.execution
17 - attack.t1552.004
18 - attack.t1059.001
19logsource:
20 product: windows
21 category: process_creation
22detection:
23 selection:
24 CommandLine|contains:
25 - 'Export-PfxCertificate '
26 - 'Export-Certificate '
27 condition: selection
28falsepositives:
29 - Legitimate certificate exports by administrators. Additional filters might be required.
30level: medium
References
-
From at least March 2020 through February 2021, the threat actor connected to the entity via the entity’s Pulse Secure VPN appliance (External Remote Services [T1133]). The threat actor connected v...
Read More -
Use this topic to help manage Windows and Windows Server technologies with Windows PowerShell.
Read More -
Explore the common certificate abuses leveraged by current and relevant adversaries in the wild, the multiple methods they use to obtain certificates, how to gather relevant logs and ways to mitigate adversaries stealing certificates.
Read More
Related rules
- Remote LSASS Process Access Through Windows Remote Management
- HackTool - CrackMapExec Execution
- PowerShell Credential Prompt
- Potentially Suspicious PowerShell Child Processes
- Obfuscation and Escape Characters - Powershell