Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Certificate Exported Via PowerShell - ScriptBlock

Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

ATT&CK coverage

Outside the enterprise matrix

T1552.004

Detection requirements

Log source product: windows
Log source category: ps_script

What the source says

What fires this without an attack behind it

Legitimate certificate exports by administrators. Additional filters might be required.

References

https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps
https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a
https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html

Tagged by the source as

attack.credential-access

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.