Detection of Unauthorized PowerShell Certificate Export

This threat brief focuses on the exploitation of the PowerShell cmdlet 'Export-Certificate' by malicious actors to target the Windows Certificate Store. Adversaries frequently attempt to gain unauthorized access to certificates to facilitate credential theft, impersonate legitimate users, or intercept and decrypt sensitive network communications. This activity is often part of a post-compromise stage where an attacker seeks to establish long-term persistence or gain further access to protected corporate resources. Defenders should monitor for execution of this cmdlet via PowerShell Script Block Logging (Event ID 4104), as its use is rarely required for routine end-user operations. The detection of this command is critical for identifying potential exfiltration of sensitive identity or encryption assets.

Attack Chain

1. Initial access is established through spearphishing, credential harvesting, or exploitation of a remote service.
2. The attacker performs initial discovery to locate the Windows Certificate Store and determine targets of interest.
3. The attacker gains administrative or elevated local privileges required to access and export certificates.
4. The attacker executes the PowerShell cmdlet 'Export-Certificate' to serialize a certificate into a file.
5. The attacker attempts to bypass file monitoring or exfiltration protections while extracting the exported file.
6. The exported certificate file is staged for exfiltration to external C2 infrastructure.
7. The final objective is the use of the stolen certificate to authenticate as a victim or decrypt intercepted traffic.

Impact

Successful exfiltration of certificates can lead to severe security incidents, including the bypass of multi-factor authentication, the decryption of encrypted communications, and the assumption of a victim's digital identity across the enterprise. These incidents can compromise the integrity of internal communications and facilitate lateral movement within the network.

Recommendation

• Deploy PowerShell Script Block Logging (Event ID 4104) across all Windows endpoints to ensure visibility into command execution.
• Implement the following detection logic in your SIEM to alert on the usage of 'Export-Certificate' across the environment.
• Audit current administrative scripts to identify and filter out legitimate business processes that require certificate exports, minimizing false positive noise.