{"id":"aa7a3fce-bef5-4311-9cc1-5f04bb8c308c","title":"Certificate Exported Via PowerShell - ScriptBlock","description":"Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2021-04-23","modified":"2023-05-18","tags":["attack.credential-access","attack.t1552.004"],"technique_ids":["T1552.004"],"logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"falsepositives":["Legitimate certificate exports by administrators. Additional filters might be required."],"references":["https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a","https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps","https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_export_certificate.yml","source_sha256":"cf02a05bb5a5aee9c14f5b5e94e797c77a782a8103c68e9947e05845f27122b2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_export_certificate.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Certificate Exported Via PowerShell - ScriptBlock\nid: aa7a3fce-bef5-4311-9cc1-5f04bb8c308c\nrelated:\n    - id: 9e716b33-63b2-46da-86a4-bd3c3b9b5dfb\n      type: similar\nstatus: test\ndescription: Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.\nreferences:\n    - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a\n    - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps\n    - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-04-23\nmodified: 2023-05-18\ntags:\n    - attack.credential-access\n    - attack.t1552.004\nlogsource:\n    product: windows\n    category: ps_script\n    definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n    selection:\n        ScriptBlockText|contains:\n            - 'Export-PfxCertificate'\n            - 'Export-Certificate'\n    filter_optional_module_export:\n        ScriptBlockText|contains: 'CmdletsToExport = @('\n    condition: selection and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate certificate exports by administrators. Additional filters might be required.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1552.004","id":"T1552.004","name":"Private Keys","page":"techniques/enterprise/T1552.004/"}],"data_path":"data/detection-rules/aa7a3fce-bef5-4311-9cc1-5f04bb8c308c.json","kind":"sigma"}