{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/certificate-theft/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows"],"_cs_severities":["medium"],"_cs_tags":["credential-access","windows","powershell","certificate-theft"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThis threat brief focuses on the potential abuse of the Windows \u003ccode\u003eExport-PfxCertificate\u003c/code\u003e PowerShell cmdlet for malicious credential access. While legitimate administrators use this command to manage certificates, adversaries often abuse it to extract private keys and certificates from the local Windows Certificate Store. By obtaining these files, an attacker can impersonate legitimate users, bypass authentication controls, or decrypt sensitive network traffic and encrypted data. The technique, identified as T1649, is frequently observed in post-exploitation scenarios where the attacker has already achieved sufficient privileges to interact with the certificate store. Defenders should monitor for suspicious execution patterns of this cmdlet, particularly when initiated by non-administrative processes or unusual parent processes.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial access to the target Windows endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker performs local reconnaissance to identify stored certificates.\u003c/li\u003e\n\u003cli\u003eAttacker uses PowerShell to invoke the \u003ccode\u003eExport-PfxCertificate\u003c/code\u003e cmdlet.\u003c/li\u003e\n\u003cli\u003eThe command targets the Local Machine or Current User certificate store.\u003c/li\u003e\n\u003cli\u003eThe certificate and associated private key are exported to a staging file (e.g., .pfx file).\u003c/li\u003e\n\u003cli\u003eThe exported file is exfiltrated from the system via C2 channels or other exfiltration methods.\u003c/li\u003e\n\u003cli\u003eAttacker uses the stolen certificate for lateral movement or authentication bypass.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful execution of this technique can result in a significant security breach, including the loss of authentication integrity, unauthorized access to secure services, and the exposure of sensitive encrypted information. The scope of impact is highly dependent on the privileges associated with the stolen certificate, potentially affecting the entire organization if high-privilege or machine-wide certificates are compromised.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule provided below to identify suspicious use of \u003ccode\u003eExport-PfxCertificate\u003c/code\u003e in your environment.\u003c/li\u003e\n\u003cli\u003eBaseline legitimate certificate management activities to reduce noise from automated utilities and administrative scripts.\u003c/li\u003e\n\u003cli\u003eImplement strict execution policies for PowerShell and monitor for execution of sensitive cmdlets by unauthorized users.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon process-creation logging (Event ID 1) to capture full command-line arguments required for detection.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:22:50Z","date_published":"2026-10-12T18:22:50Z","id":"https://feed.craftedsignal.io/briefs/2026-10-windows-pfx-export/","summary":"Adversaries may use the PowerShell cmdlet Export-PfxCertificate to exfiltrate authentication certificates from the Windows Certificate Store, enabling identity impersonation and data decryption.","title":"Detection of Unauthorized Certificate Export via PowerShell","url":"https://feed.craftedsignal.io/briefs/2026-10-windows-pfx-export/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["credential-access","windows","powershell","certificate-theft"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAdversaries are known to leverage built-in Windows administrative utilities to facilitate post-exploitation activities. Specifically, the PowerShell cmdlet 'Export-Certificate' is being utilized to extract authentication certificates from the local Windows Certificate Store. This activity is a precursor to more severe threats, such as user impersonation, the decryption of sensitive network or local traffic, and unauthorized access to protected enterprise systems. By exporting certificates, an attacker gains the ability to effectively clone identities or intercept encrypted communication channels, bypassing traditional authentication mechanisms. Detection engineering teams must focus on monitoring process execution telemetry to identify the use of this cmdlet, which is often executed in the context of broader credential harvesting campaigns. This technique is formally documented under MITRE ATT\u0026amp;CK T1649.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this technique allows an attacker to obtain valid authentication material from compromised hosts. This grants them the ability to impersonate legitimate users, potentially leading to unauthorized access to internal services, data exfiltration, or the decryption of encrypted traffic. The impact is elevated in environments relying heavily on certificate-based authentication or PKI infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect suspicious process execution involving 'Export-Certificate'.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon Event ID 1 or Windows Event ID 4688 to capture full command-line arguments for all PowerShell executions.\u003c/li\u003e\n\u003cli\u003eFilter common administrative tools or legitimate management scripts that utilize certificate export functions to reduce false positives.\u003c/li\u003e\n\u003cli\u003eMonitor for unusual parent-child process relationships, such as web servers or office applications spawning PowerShell to execute certificate management commands.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:22:42Z","date_published":"2026-10-12T18:22:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-windows-certificate-export/","summary":"Adversaries abuse the PowerShell Export-Certificate cmdlet to exfiltrate authentication certificates from the Windows Certificate Store for use in credential theft and man-in-the-middle attacks.","title":"Abuse of PowerShell Export-Certificate for Credential Theft","url":"https://feed.craftedsignal.io/briefs/2026-10-windows-certificate-export/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows"],"_cs_severities":["medium"],"_cs_tags":["credential-access","windows","cpi2","certificate-theft"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThe extraction of authentication certificates from the Windows certificate store is a critical phase in credential access attacks. This activity is frequently observed when adversaries utilize specialized tools, such as Mimikatz or Cobalt Strike, to acquire private keys associated with certificates. By monitoring the Microsoft-Windows-CAPI2/Operational log, specifically EventID 70, security teams can identify when a private key is accessed or exported. This technique is often linked to sophisticated actors, including those involved in ransomware operations like Hellcat, who leverage compromised certificates to impersonate legitimate users, escalate privileges, or maintain persistence within a network. Given that CAPI2 logging is not enabled by default and serves as a debug-level log, detection engineers must ensure proper log enablement and tuning to mitigate the risk of excessive noise from legitimate administrative operations.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this technique enables attackers to bypass standard authentication mechanisms by impersonating high-privilege users or service accounts. This facilitates lateral movement, unauthorized access to sensitive data, and further privilege escalation, ultimately posing a severe threat to the integrity and confidentiality of the organization's identity infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable the Microsoft-Windows-CAPI2/Operational log on all Windows endpoints to capture EventID 70.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to monitor for certificate private key acquisition events.\u003c/li\u003e\n\u003cli\u003eTune the detection logic by filtering known administrative tools or legitimate system services that perform authorized certificate maintenance to reduce false positives.\u003c/li\u003e\n\u003cli\u003eReview the documentation provided by Red Canary's Atomic Red Team (T1649) to validate your organization's logging posture against this specific TTP.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:22:34Z","date_published":"2026-10-12T18:22:34Z","id":"https://feed.craftedsignal.io/briefs/2026-10-windows-cryptoapi-cert-theft/","summary":"This detection identifies the illicit extraction of authentication certificates by monitoring Windows CAPI2 logs for EventID 70, a technique commonly utilized by attackers to perform credential theft and user impersonation.","title":"Detection of Authentication Certificate Extraction via Windows CryptoAPI","url":"https://feed.craftedsignal.io/briefs/2026-10-windows-cryptoapi-cert-theft/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows"],"_cs_severities":["medium"],"_cs_tags":["credential-access","power-shell","windows","certificate-theft"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThis threat brief focuses on the exploitation of the PowerShell cmdlet 'Export-Certificate' by malicious actors to target the Windows Certificate Store. Adversaries frequently attempt to gain unauthorized access to certificates to facilitate credential theft, impersonate legitimate users, or intercept and decrypt sensitive network communications. This activity is often part of a post-compromise stage where an attacker seeks to establish long-term persistence or gain further access to protected corporate resources. Defenders should monitor for execution of this cmdlet via PowerShell Script Block Logging (Event ID 4104), as its use is rarely required for routine end-user operations. The detection of this command is critical for identifying potential exfiltration of sensitive identity or encryption assets.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial access is established through spearphishing, credential harvesting, or exploitation of a remote service.\u003c/li\u003e\n\u003cli\u003eThe attacker performs initial discovery to locate the Windows Certificate Store and determine targets of interest.\u003c/li\u003e\n\u003cli\u003eThe attacker gains administrative or elevated local privileges required to access and export certificates.\u003c/li\u003e\n\u003cli\u003eThe attacker executes the PowerShell cmdlet 'Export-Certificate' to serialize a certificate into a file.\u003c/li\u003e\n\u003cli\u003eThe attacker attempts to bypass file monitoring or exfiltration protections while extracting the exported file.\u003c/li\u003e\n\u003cli\u003eThe exported certificate file is staged for exfiltration to external C2 infrastructure.\u003c/li\u003e\n\u003cli\u003eThe final objective is the use of the stolen certificate to authenticate as a victim or decrypt intercepted traffic.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exfiltration of certificates can lead to severe security incidents, including the bypass of multi-factor authentication, the decryption of encrypted communications, and the assumption of a victim's digital identity across the enterprise. These incidents can compromise the integrity of internal communications and facilitate lateral movement within the network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy PowerShell Script Block Logging (Event ID 4104) across all Windows endpoints to ensure visibility into command execution.\u003c/li\u003e\n\u003cli\u003eImplement the following detection logic in your SIEM to alert on the usage of 'Export-Certificate' across the environment.\u003c/li\u003e\n\u003cli\u003eAudit current administrative scripts to identify and filter out legitimate business processes that require certificate exports, minimizing false positive noise.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:17:59Z","date_published":"2026-10-12T18:17:59Z","id":"https://feed.craftedsignal.io/briefs/2026-10-windows-powershell-export-certificate/","summary":"Adversaries may leverage the PowerShell cmdlet 'Export-Certificate' to exfiltrate cryptographic material from the Windows Certificate Store, enabling impersonation and decryption of sensitive data.","title":"Detection of Unauthorized PowerShell Certificate Export","url":"https://feed.craftedsignal.io/briefs/2026-10-windows-powershell-export-certificate/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["credential-access","mimikatz","certificate-theft","endpoint-security"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Mimikatz 'crypto' module is a specialized component used by threat actors to interact with the Windows CryptoAPI for the purpose of exporting certificates and associated private keys. This activity is a classic indicator of credential harvesting or the theft of sensitive cryptographic material from a compromised host. By targeting specific file extensions - such as .pvk, .p8k, .pfx, and .der - defenders can identify the use of Mimikatz or automated scripts (such as those found in Atomic Red Team) that perform these export operations. Detecting these files on disk shortly after creation is critical for identifying unauthorized attempts to exfiltrate identities and cryptographic assets, which can then be used for persistent access or further lateral movement within an environment.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains local administrative or SYSTEM access to the target endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker executes Mimikatz with elevated privileges to interact with the Windows Certificate Store.\u003c/li\u003e\n\u003cli\u003eAttacker loads the Mimikatz 'crypto' module to enumerate available certificates and private keys.\u003c/li\u003e\n\u003cli\u003eAttacker executes export commands for targeted certificates.\u003c/li\u003e\n\u003cli\u003eMimikatz writes the exported keys and certificates to disk with specific extensions (e.g., .pvk, .pfx).\u003c/li\u003e\n\u003cli\u003eAttacker gathers these files for exfiltration or subsequent use in authentication bypass or impersonation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exfiltration of cryptographic keys and certificates allows an attacker to impersonate identities, decrypt captured traffic, or bypass authentication mechanisms relying on certificate-based security. This can lead to broad unauthorized access within an organization's network, effectively bypassing standard password-based protections.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to monitor for the creation of files with extensions associated with the Mimikatz crypto module.\u003c/li\u003e\n\u003cli\u003ePrioritize alerts originating from high-value systems, such as domain controllers, file servers, or administrative workstations.\u003c/li\u003e\n\u003cli\u003eInvestigate the process associated with the file creation event to confirm if it is a legitimate administrative tool or a malicious binary.\u003c/li\u003e\n\u003cli\u003eConsider removing .pfx files from the alert if they generate excessive noise, focusing initially on more specific extensions like .pvk and .p8k.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:09:08Z","date_published":"2026-10-12T18:09:08Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mimikatz-crypto-export/","summary":"This detection identifies the creation of specific file extensions indicative of the Mimikatz 'crypto' module, which is used to export cryptographic keys and certificates during credential theft activities.","title":"Detection of Mimikatz Crypto Module Certificate and Key Export","url":"https://feed.craftedsignal.io/briefs/2026-10-mimikatz-crypto-export/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Active Directory Certificate Services"],"_cs_severities":["high"],"_cs_tags":["certificate-theft","identity-compromise","adcs","credential-access"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThis threat brief focuses on the identification of adversary behavior targeting Active Directory Certificate Services (AD CS). By monitoring for the theft or forgery of authentication certificates, security teams can detect attempts to compromise core identity and authentication infrastructure. The methodology relies on aggregating risk signals from the \u0026quot;Windows Certificate Services\u0026quot; analytic story. When an endpoint generates five or more distinct security events related to certificate manipulation within a set timeframe, it indicates a high-probability attempt to bypass authentication controls. Such activity is a precursor to lateral movement, privilege escalation, or persistence, enabling attackers to gain unauthorized access to sensitive systems or impersonate privileged users.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of authentication certificate infrastructure allows adversaries to maintain persistent, high-privileged access to a Windows domain. By forging certificates or stealing existing ones, an attacker can bypass traditional credential-based authentication, making their presence difficult to detect via standard identity monitoring. If this activity is confirmed as malicious, it represents a severe security breach that may necessitate a full recovery of the environment's identity and trust infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the investigation of systems identified by the aggregation of risk signals related to the \u0026quot;Windows Certificate Services\u0026quot; story.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eEnsure all individual analytic rules within the Windows Certificate Services story are enabled and correctly tuned to reduce baseline noise.\u003c/li\u003e\n\u003cli\u003eReview telemetry from Windows Event Logs, specifically focusing on certificate request and issuance events on Active Directory Certificate Services servers.\u003c/li\u003e\n\u003cli\u003eUse the risk-based drilldown provided by your SIEM to examine the specific sequence of alerts triggered on the flagged risk object.\u003c/li\u003e\n\u003cli\u003eInvestigate the processes and users associated with the identified certificate manipulation to determine if the activity is authorized administrative maintenance or a potential security compromise.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T17:58:56Z","date_published":"2026-10-12T17:58:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-steal-or-forge-auth-certs/","summary":"This correlation identifies anomalous activity targeting Windows Certificate Services by aggregating multiple risk-based detections on a single system, signaling potential adversary efforts to forge or steal authentication certificates.","title":"Detection of Authentication Certificate Theft or Forgery","url":"https://feed.craftedsignal.io/briefs/2026-10-steal-or-forge-auth-certs/"}],"language":"en","title":"CraftedSignal Threat Feed - Certificate-Theft","version":"https://jsonfeed.org/version/1.1"}