Detection of Mimikatz Crypto Module Certificate and Key Export

The Mimikatz 'crypto' module is a specialized component used by threat actors to interact with the Windows CryptoAPI for the purpose of exporting certificates and associated private keys. This activity is a classic indicator of credential harvesting or the theft of sensitive cryptographic material from a compromised host. By targeting specific file extensions - such as .pvk, .p8k, .pfx, and .der - defenders can identify the use of Mimikatz or automated scripts (such as those found in Atomic Red Team) that perform these export operations. Detecting these files on disk shortly after creation is critical for identifying unauthorized attempts to exfiltrate identities and cryptographic assets, which can then be used for persistent access or further lateral movement within an environment.

Attack Chain

1. Attacker gains local administrative or SYSTEM access to the target endpoint.
2. Attacker executes Mimikatz with elevated privileges to interact with the Windows Certificate Store.
3. Attacker loads the Mimikatz 'crypto' module to enumerate available certificates and private keys.
4. Attacker executes export commands for targeted certificates.
5. Mimikatz writes the exported keys and certificates to disk with specific extensions (e.g., .pvk, .pfx).
6. Attacker gathers these files for exfiltration or subsequent use in authentication bypass or impersonation.

Impact

Successful exfiltration of cryptographic keys and certificates allows an attacker to impersonate identities, decrypt captured traffic, or bypass authentication mechanisms relying on certificate-based security. This can lead to broad unauthorized access within an organization's network, effectively bypassing standard password-based protections.

Recommendation

• Deploy the provided Sigma rule to monitor for the creation of files with extensions associated with the Mimikatz crypto module.
• Prioritize alerts originating from high-value systems, such as domain controllers, file servers, or administrative workstations.
• Investigate the process associated with the file creation event to confirm if it is a legitimate administrative tool or a malicious binary.
• Consider removing .pfx files from the alert if they generate excessive noise, focusing initially on more specific extensions like .pvk and .p8k.