{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cpi2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows"],"_cs_severities":["medium"],"_cs_tags":["credential-access","windows","cpi2","certificate-theft"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThe extraction of authentication certificates from the Windows certificate store is a critical phase in credential access attacks. This activity is frequently observed when adversaries utilize specialized tools, such as Mimikatz or Cobalt Strike, to acquire private keys associated with certificates. By monitoring the Microsoft-Windows-CAPI2/Operational log, specifically EventID 70, security teams can identify when a private key is accessed or exported. This technique is often linked to sophisticated actors, including those involved in ransomware operations like Hellcat, who leverage compromised certificates to impersonate legitimate users, escalate privileges, or maintain persistence within a network. Given that CAPI2 logging is not enabled by default and serves as a debug-level log, detection engineers must ensure proper log enablement and tuning to mitigate the risk of excessive noise from legitimate administrative operations.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this technique enables attackers to bypass standard authentication mechanisms by impersonating high-privilege users or service accounts. This facilitates lateral movement, unauthorized access to sensitive data, and further privilege escalation, ultimately posing a severe threat to the integrity and confidentiality of the organization's identity infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnable the Microsoft-Windows-CAPI2/Operational log on all Windows endpoints to capture EventID 70.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to monitor for certificate private key acquisition events.\u003c/li\u003e\n\u003cli\u003eTune the detection logic by filtering known administrative tools or legitimate system services that perform authorized certificate maintenance to reduce false positives.\u003c/li\u003e\n\u003cli\u003eReview the documentation provided by Red Canary's Atomic Red Team (T1649) to validate your organization's logging posture against this specific TTP.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:22:34Z","date_published":"2026-10-12T18:22:34Z","id":"https://feed.craftedsignal.io/briefs/2026-10-windows-cryptoapi-cert-theft/","summary":"This detection identifies the illicit extraction of authentication certificates by monitoring Windows CAPI2 logs for EventID 70, a technique commonly utilized by attackers to perform credential theft and user impersonation.","title":"Detection of Authentication Certificate Extraction via Windows CryptoAPI","url":"https://feed.craftedsignal.io/briefs/2026-10-windows-cryptoapi-cert-theft/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpi2","version":"https://jsonfeed.org/version/1.1"}