Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.

Read More

Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.

Read More

Detects when an application acquires a certificate private key

Read More

Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.

Read More