attack.t1649 | Detection.FYI

Certificate Exported From Local Certificate Store
May 18, 2023 · attack.credential_access attack.t1649 ·
Share on:
Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.

Read More
Certificate Private Key Acquired
May 18, 2023 · attack.credential_access attack.t1649 ·
Share on:
Detects when an application acquires a certificate private key

Read More
HackTool - Certify Execution
Apr 25, 2023 · attack.discovery attack.credential_access attack.t1649 ·
Share on:
Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.

Read More
HackTool - Certipy Execution
Apr 21, 2023 · attack.discovery attack.credential_access attack.t1649 ·
Share on:
Detects Certipy a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.

Read More