Detection of Authentication Certificate Extraction via Windows CryptoAPI

The extraction of authentication certificates from the Windows certificate store is a critical phase in credential access attacks. This activity is frequently observed when adversaries utilize specialized tools, such as Mimikatz or Cobalt Strike, to acquire private keys associated with certificates. By monitoring the Microsoft-Windows-CAPI2/Operational log, specifically EventID 70, security teams can identify when a private key is accessed or exported. This technique is often linked to sophisticated actors, including those involved in ransomware operations like Hellcat, who leverage compromised certificates to impersonate legitimate users, escalate privileges, or maintain persistence within a network. Given that CAPI2 logging is not enabled by default and serves as a debug-level log, detection engineers must ensure proper log enablement and tuning to mitigate the risk of excessive noise from legitimate administrative operations.

Impact

Successful exploitation of this technique enables attackers to bypass standard authentication mechanisms by impersonating high-privilege users or service accounts. This facilitates lateral movement, unauthorized access to sensitive data, and further privilege escalation, ultimately posing a severe threat to the integrity and confidentiality of the organization's identity infrastructure.

Recommendation

• Enable the Microsoft-Windows-CAPI2/Operational log on all Windows endpoints to capture EventID 70.
• Deploy the provided Sigma rule to monitor for certificate private key acquisition events.
• Tune the detection logic by filtering known administrative tools or legitimate system services that perform authorized certificate maintenance to reduce false positives.
• Review the documentation provided by Red Canary's Atomic Red Team (T1649) to validate your organization's logging posture against this specific TTP.