Detection of Unauthorized PowerShell PFX Certificate Export

The use of the PowerShell cmdlet Export-PfxCertificate presents a significant security risk when observed in production environments. Threat actors utilize this native functionality to extract certificates along with their private keys from the Windows Certificate Store. This activity is frequently associated with credential access and collection tactics, enabling attackers to bypass secure communication protocols, perform unauthorized authentication, and escalate privileges. Monitoring for this behavior is essential for identifying early signs of certificate theft that could lead to widespread environment compromise or long-term persistence through identity-based attacks. Defenders should focus on PowerShell Script Block Logging (EventID 4104) to capture the execution of this specific cmdlet.

Attack Chain

1. Attacker gains initial access or code execution on the target Windows endpoint.
2. Attacker explores the local Windows Certificate Store to identify high-value certificates (e.g., code signing or authentication certificates).
3. Attacker uses PowerShell to interact with the PKI module.
4. Attacker executes Export-PfxCertificate to export the target certificate and associated private key to a file on disk.
5. The command execution triggers a PowerShell Script Block (Event ID 4104) containing the cmdlet string.
6. Attacker exfiltrates the exported .pfx file to an external, attacker-controlled server.
7. Attacker uses the stolen certificate to perform man-in-the-middle attacks or impersonate legitimate identities.

Impact

Successful exploitation allows attackers to compromise encrypted communications, authenticate as legitimate users, and potentially gain elevated access to internal systems. While the technique is often used by targeted threat actors, the impact is severe if production or administrative certificates are successfully exfiltrated, leading to a complete compromise of the identity layer within the targeted network.

Recommendation

• Enable PowerShell Script Block Logging (Event ID 4104) on all Windows endpoints to ensure visibility into cmdlet execution.
• Deploy the detection rule below to your SIEM to monitor for the use of Export-PfxCertificate.
• Review administrative scripts that legitimately use this cmdlet and establish a process for tuning the detection to reduce noise from authorized maintenance activity.