Tag
Detection of Unauthorized Certificate Export via PowerShell
1 rule 2 TTPsAdversaries may use the PowerShell cmdlet Export-PfxCertificate to exfiltrate authentication certificates from the Windows Certificate Store, enabling identity impersonation and data decryption.
Abuse of PowerShell Export-Certificate for Credential Theft
1 rule 1 TTPAdversaries abuse the PowerShell Export-Certificate cmdlet to exfiltrate authentication certificates from the Windows Certificate Store for use in credential theft and man-in-the-middle attacks.
Detection of Authentication Certificate Extraction via Windows CryptoAPI
1 rule 1 TTPThis detection identifies the illicit extraction of authentication certificates by monitoring Windows CAPI2 logs for EventID 70, a technique commonly utilized by attackers to perform credential theft and user impersonation.
Detection of Unauthorized PowerShell Certificate Export
1 rule 2 TTPsAdversaries may leverage the PowerShell cmdlet 'Export-Certificate' to exfiltrate cryptographic material from the Windows Certificate Store, enabling impersonation and decryption of sensitive data.
Detection of Mimikatz Crypto Module Certificate and Key Export
1 rule 2 TTPsThis detection identifies the creation of specific file extensions indicative of the Mimikatz 'crypto' module, which is used to export cryptographic keys and certificates during credential theft activities.
Detection of Authentication Certificate Theft or Forgery
1 TTPThis correlation identifies anomalous activity targeting Windows Certificate Services by aggregating multiple risk-based detections on a single system, signaling potential adversary efforts to forge or steal authentication certificates.