attack.t1649

HackTool - Certipy Execution

Oct 8, 2024 · attack.discovery attack.credential-access attack.t1649 ·

Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.

Certificate Exported From Local Certificate Store

Aug 12, 2024 · attack.credential-access attack.t1649 ·

Share on:

Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.

Certificate Private Key Acquired

Aug 12, 2024 · attack.credential-access attack.t1649 ·

Share on:

Detects when an application acquires a certificate private key

HackTool - Certify Execution

Aug 12, 2024 · attack.discovery attack.credential-access attack.t1649 ·

Share on:

Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.