Abuse of PowerShell Export-Certificate for Credential Theft

Adversaries are known to leverage built-in Windows administrative utilities to facilitate post-exploitation activities. Specifically, the PowerShell cmdlet 'Export-Certificate' is being utilized to extract authentication certificates from the local Windows Certificate Store. This activity is a precursor to more severe threats, such as user impersonation, the decryption of sensitive network or local traffic, and unauthorized access to protected enterprise systems. By exporting certificates, an attacker gains the ability to effectively clone identities or intercept encrypted communication channels, bypassing traditional authentication mechanisms. Detection engineering teams must focus on monitoring process execution telemetry to identify the use of this cmdlet, which is often executed in the context of broader credential harvesting campaigns. This technique is formally documented under MITRE ATT&CK T1649.

Impact

Successful exploitation of this technique allows an attacker to obtain valid authentication material from compromised hosts. This grants them the ability to impersonate legitimate users, potentially leading to unauthorized access to internal services, data exfiltration, or the decryption of encrypted traffic. The impact is elevated in environments relying heavily on certificate-based authentication or PKI infrastructure.

Recommendation

• Deploy the provided Sigma rule to detect suspicious process execution involving 'Export-Certificate'.
• Enable Sysmon Event ID 1 or Windows Event ID 4688 to capture full command-line arguments for all PowerShell executions.
• Filter common administrative tools or legitimate management scripts that utilize certificate export functions to reduce false positives.
• Monitor for unusual parent-child process relationships, such as web servers or office applications spawning PowerShell to execute certificate management commands.