Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

Read More

Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

Read More

Show when private keys are being exported from the device, or when new certificates are installed

Read More

Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.

Read More

Detects a "Get-Process" cmdlet and it's aliases on lsass process, which is in almost all cases a sign of malicious activity

Read More

Adversaries may search for private key certificate files on compromised systems for insecurely stored credential

Read More

A general detection for processes creating PFX files. This could be an indicator of an adversary exporting a local certificate to a PFX file.

Read More