Attack Chain

1. Attacker gains initial access to the target Windows endpoint.
2. Attacker performs local reconnaissance to identify stored certificates.
3. Attacker uses PowerShell to invoke the Export-PfxCertificate cmdlet.
4. The command targets the Local Machine or Current User certificate store.
5. The certificate and associated private key are exported to a staging file (e.g., .pfx file).
6. The exported file is exfiltrated from the system via C2 channels or other exfiltration methods.
7. Attacker uses the stolen certificate for lateral movement or authentication bypass.

Impact

Successful execution of this technique can result in a significant security breach, including the loss of authentication integrity, unauthorized access to secure services, and the exposure of sensitive encrypted information. The scope of impact is highly dependent on the privileges associated with the stolen certificate, potentially affecting the entire organization if high-privilege or machine-wide certificates are compromised.

Recommendation

• Deploy the Sigma rule provided below to identify suspicious use of Export-PfxCertificate in your environment.
• Baseline legitimate certificate management activities to reduce noise from automated utilities and administrative scripts.
• Implement strict execution policies for PowerShell and monitor for execution of sensitive cmdlets by unauthorized users.
• Enable Sysmon process-creation logging (Event ID 1) to capture full command-line arguments required for detection.

Impact

Successful exploitation of this technique allows an attacker to obtain valid authentication material from compromised hosts. This grants them the ability to impersonate legitimate users, potentially leading to unauthorized access to internal services, data exfiltration, or the decryption of encrypted traffic. The impact is elevated in environments relying heavily on certificate-based authentication or PKI infrastructure.

Recommendation

• Deploy the provided Sigma rule to detect suspicious process execution involving 'Export-Certificate'.
• Enable Sysmon Event ID 1 or Windows Event ID 4688 to capture full command-line arguments for all PowerShell executions.
• Filter common administrative tools or legitimate management scripts that utilize certificate export functions to reduce false positives.
• Monitor for unusual parent-child process relationships, such as web servers or office applications spawning PowerShell to execute certificate management commands.

Impact

Successful exploitation of this technique enables attackers to bypass standard authentication mechanisms by impersonating high-privilege users or service accounts. This facilitates lateral movement, unauthorized access to sensitive data, and further privilege escalation, ultimately posing a severe threat to the integrity and confidentiality of the organization's identity infrastructure.

Recommendation

• Enable the Microsoft-Windows-CAPI2/Operational log on all Windows endpoints to capture EventID 70.
• Deploy the provided Sigma rule to monitor for certificate private key acquisition events.
• Tune the detection logic by filtering known administrative tools or legitimate system services that perform authorized certificate maintenance to reduce false positives.
• Review the documentation provided by Red Canary's Atomic Red Team (T1649) to validate your organization's logging posture against this specific TTP.

Attack Chain

1. Initial access is established through spearphishing, credential harvesting, or exploitation of a remote service.
2. The attacker performs initial discovery to locate the Windows Certificate Store and determine targets of interest.
3. The attacker gains administrative or elevated local privileges required to access and export certificates.
4. The attacker executes the PowerShell cmdlet 'Export-Certificate' to serialize a certificate into a file.
5. The attacker attempts to bypass file monitoring or exfiltration protections while extracting the exported file.
6. The exported certificate file is staged for exfiltration to external C2 infrastructure.
7. The final objective is the use of the stolen certificate to authenticate as a victim or decrypt intercepted traffic.

Impact

Successful exfiltration of certificates can lead to severe security incidents, including the bypass of multi-factor authentication, the decryption of encrypted communications, and the assumption of a victim's digital identity across the enterprise. These incidents can compromise the integrity of internal communications and facilitate lateral movement within the network.

Recommendation

• Deploy PowerShell Script Block Logging (Event ID 4104) across all Windows endpoints to ensure visibility into command execution.
• Implement the following detection logic in your SIEM to alert on the usage of 'Export-Certificate' across the environment.
• Audit current administrative scripts to identify and filter out legitimate business processes that require certificate exports, minimizing false positive noise.

Attack Chain

1. Attacker gains local administrative or SYSTEM access to the target endpoint.
2. Attacker executes Mimikatz with elevated privileges to interact with the Windows Certificate Store.
3. Attacker loads the Mimikatz 'crypto' module to enumerate available certificates and private keys.
4. Attacker executes export commands for targeted certificates.
5. Mimikatz writes the exported keys and certificates to disk with specific extensions (e.g., .pvk, .pfx).
6. Attacker gathers these files for exfiltration or subsequent use in authentication bypass or impersonation.

Impact

Successful exfiltration of cryptographic keys and certificates allows an attacker to impersonate identities, decrypt captured traffic, or bypass authentication mechanisms relying on certificate-based security. This can lead to broad unauthorized access within an organization's network, effectively bypassing standard password-based protections.

Recommendation

• Deploy the provided Sigma rule to monitor for the creation of files with extensions associated with the Mimikatz crypto module.
• Prioritize alerts originating from high-value systems, such as domain controllers, file servers, or administrative workstations.
• Investigate the process associated with the file creation event to confirm if it is a legitimate administrative tool or a malicious binary.
• Consider removing .pfx files from the alert if they generate excessive noise, focusing initially on more specific extensions like .pvk and .p8k.

Impact

Successful exploitation of authentication certificate infrastructure allows adversaries to maintain persistent, high-privileged access to a Windows domain. By forging certificates or stealing existing ones, an attacker can bypass traditional credential-based authentication, making their presence difficult to detect via standard identity monitoring. If this activity is confirmed as malicious, it represents a severe security breach that may necessitate a full recovery of the environment's identity and trust infrastructure.

Recommendation

Prioritize the investigation of systems identified by the aggregation of risk signals related to the "Windows Certificate Services" story.

• Ensure all individual analytic rules within the Windows Certificate Services story are enabled and correctly tuned to reduce baseline noise.
• Review telemetry from Windows Event Logs, specifically focusing on certificate request and issuance events on Active Directory Certificate Services servers.
• Use the risk-based drilldown provided by your SIEM to examine the specific sequence of alerts triggered on the flagged risk object.
• Investigate the processes and users associated with the identified certificate manipulation to determine if the activity is authorized administrative maintenance or a potential security compromise.