PowerShell Certificate Export Cmdlets in Windows Process Creation

title: PowerShell Certificate Export Cmdlets in Windows Process Creation
id: db3bbbdc-ccf1-4af6-b888-9a56091441d9
related:
  - id: aa7a3fce-bef5-4311-9cc1-5f04bb8c308c
    type: similar
  - id: 9e716b33-63b2-46da-86a4-bd3c3b9b5dfb
    type: derived
status: test
description: "This rule identifies Windows processes whose command lines include PowerShell cmdlets used to export certificates from the local store: Export-PfxCertificate and Export-Certificate. Certificate export can enable credential access by allowing an attacker to retrieve private key material from a compromised host. It relies on process creation telemetry, specifically the presence of these cmdlet strings in the command line."
references:
  - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a
  - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps
  - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_export_certificate.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-18
tags:
  - attack.credential-access
  - attack.execution
  - attack.t1552.004
  - attack.t1059.001
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - "Export-PfxCertificate "
      - "Export-Certificate "
  condition: selection
falsepositives:
  - Legitimate certificate exports by administrators. Additional filters might be required.
level: medium
license: DRL-1.1