{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/power-shell/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows"],"_cs_severities":["medium"],"_cs_tags":["credential-access","power-shell","windows","certificate-theft"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eThis threat brief focuses on the exploitation of the PowerShell cmdlet 'Export-Certificate' by malicious actors to target the Windows Certificate Store. Adversaries frequently attempt to gain unauthorized access to certificates to facilitate credential theft, impersonate legitimate users, or intercept and decrypt sensitive network communications. This activity is often part of a post-compromise stage where an attacker seeks to establish long-term persistence or gain further access to protected corporate resources. Defenders should monitor for execution of this cmdlet via PowerShell Script Block Logging (Event ID 4104), as its use is rarely required for routine end-user operations. The detection of this command is critical for identifying potential exfiltration of sensitive identity or encryption assets.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial access is established through spearphishing, credential harvesting, or exploitation of a remote service.\u003c/li\u003e\n\u003cli\u003eThe attacker performs initial discovery to locate the Windows Certificate Store and determine targets of interest.\u003c/li\u003e\n\u003cli\u003eThe attacker gains administrative or elevated local privileges required to access and export certificates.\u003c/li\u003e\n\u003cli\u003eThe attacker executes the PowerShell cmdlet 'Export-Certificate' to serialize a certificate into a file.\u003c/li\u003e\n\u003cli\u003eThe attacker attempts to bypass file monitoring or exfiltration protections while extracting the exported file.\u003c/li\u003e\n\u003cli\u003eThe exported certificate file is staged for exfiltration to external C2 infrastructure.\u003c/li\u003e\n\u003cli\u003eThe final objective is the use of the stolen certificate to authenticate as a victim or decrypt intercepted traffic.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exfiltration of certificates can lead to severe security incidents, including the bypass of multi-factor authentication, the decryption of encrypted communications, and the assumption of a victim's digital identity across the enterprise. These incidents can compromise the integrity of internal communications and facilitate lateral movement within the network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy PowerShell Script Block Logging (Event ID 4104) across all Windows endpoints to ensure visibility into command execution.\u003c/li\u003e\n\u003cli\u003eImplement the following detection logic in your SIEM to alert on the usage of 'Export-Certificate' across the environment.\u003c/li\u003e\n\u003cli\u003eAudit current administrative scripts to identify and filter out legitimate business processes that require certificate exports, minimizing false positive noise.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:17:59Z","date_published":"2026-10-12T18:17:59Z","id":"https://feed.craftedsignal.io/briefs/2026-10-windows-powershell-export-certificate/","summary":"Adversaries may leverage the PowerShell cmdlet 'Export-Certificate' to exfiltrate cryptographic material from the Windows Certificate Store, enabling impersonation and decryption of sensitive data.","title":"Detection of Unauthorized PowerShell Certificate Export","url":"https://feed.craftedsignal.io/briefs/2026-10-windows-powershell-export-certificate/"}],"language":"en","title":"CraftedSignal Threat Feed - Power-Shell","version":"https://jsonfeed.org/version/1.1"}