Private Keys Reconnaissance Via Command Line Tools

Adversaries frequently perform reconnaissance on compromised endpoints to identify sensitive cryptographic material stored in insecure locations. By leveraging standard command line interfaces and built-in Windows utilities, attackers can recursively search for common file extensions associated with private keys, PGP/GPG configurations, and certificates. This activity is a common precursor to credential theft and lateral movement, as these files may grant unauthorized access to remote services, encrypted data, or developer environments. Detecting this behavior is essential, as the tools used (cmd, PowerShell, findstr) are native to the operating system and often blend into normal administrative activity.

Attack Chain

1. Attacker gains interactive command execution access on a Windows endpoint.
2. Attacker identifies potential directory paths of interest (e.g., user profiles, SSH configs, or development folders).
3. Attacker initiates a search for specific file extensions using dir, Get-ChildItem, or findstr /s.
4. The search targets extensions including .key, .pgp, .gpg, .ppk, .p12, .pem, .pfx, .cer, .p7b, or .asc.
5. Attacker observes command output to verify the presence of keys on the local disk.
6. Attacker exfiltrates or directly utilizes discovered private keys for persistence or unauthorized access.

Impact

Successful reconnaissance of private keys leads to the compromise of identity-based assets, potential exfiltration of encrypted communications, and the bypass of multi-factor authentication systems that rely on certificate-based authentication. If attackers secure these keys, they can establish long-term persistence within development or infrastructure environments, leading to potential supply chain or data integrity breaches.

Recommendation

Deploy detection rules to monitor for recursive file listing operations that target sensitive cryptographic file extensions.

• Implement the provided Sigma rule to alert on suspicious combinations of file search commands and key-related extensions.
• Review baseline administrative scripts in the environment to identify legitimate automated key management tasks and tune out noise.
• Use endpoint detection and response (EDR) telemetry to correlate the reconnaissance activity with subsequent suspicious file access or egress traffic.