Detection of Unauthorized Certificate Export via PowerShell

This threat brief focuses on the potential abuse of the Windows Export-PfxCertificate PowerShell cmdlet for malicious credential access. While legitimate administrators use this command to manage certificates, adversaries often abuse it to extract private keys and certificates from the local Windows Certificate Store. By obtaining these files, an attacker can impersonate legitimate users, bypass authentication controls, or decrypt sensitive network traffic and encrypted data. The technique, identified as T1649, is frequently observed in post-exploitation scenarios where the attacker has already achieved sufficient privileges to interact with the certificate store. Defenders should monitor for suspicious execution patterns of this cmdlet, particularly when initiated by non-administrative processes or unusual parent processes.

Attack Chain

1. Attacker gains initial access to the target Windows endpoint.
2. Attacker performs local reconnaissance to identify stored certificates.
3. Attacker uses PowerShell to invoke the Export-PfxCertificate cmdlet.
4. The command targets the Local Machine or Current User certificate store.
5. The certificate and associated private key are exported to a staging file (e.g., .pfx file).
6. The exported file is exfiltrated from the system via C2 channels or other exfiltration methods.
7. Attacker uses the stolen certificate for lateral movement or authentication bypass.

Impact

Successful execution of this technique can result in a significant security breach, including the loss of authentication integrity, unauthorized access to secure services, and the exposure of sensitive encrypted information. The scope of impact is highly dependent on the privileges associated with the stolen certificate, potentially affecting the entire organization if high-privilege or machine-wide certificates are compromised.

Recommendation

• Deploy the Sigma rule provided below to identify suspicious use of Export-PfxCertificate in your environment.
• Baseline legitimate certificate management activities to reduce noise from automated utilities and administrative scripts.
• Implement strict execution policies for PowerShell and monitor for execution of sensitive cmdlets by unauthorized users.
• Enable Sysmon process-creation logging (Event ID 1) to capture full command-line arguments required for detection.