PowerShell ScriptBlock Certificate Export via Export-PfxCertificate or Export-Certificate

Detects PowerShell script blocks invoking certificate export cmdlets, which may be abused to steal sensitive certificate material.

FreeUnreviewedSigmamediumv1

powershell-scriptblock-certificate-export-via-export-pfxcertificate-or-export-ce-aa7a3fce

title: PowerShell ScriptBlock Certificate Export via Export-PfxCertificate or Export-Certificate
id: 23b426ef-9c65-48ee-bf52-5f70b22c3c64
related:
  - id: 9e716b33-63b2-46da-86a4-bd3c3b9b5dfb
    type: similar
  - id: aa7a3fce-bef5-4311-9cc1-5f04bb8c308c
    type: derived
status: test
description: This rule flags PowerShell script blocks that contain certificate export cmdlets, specifically Export-PfxCertificate and Export-Certificate. Exporting certificates from the local store can be used to access or exfiltrate sensitive certificate material, including private keys, from a host. It relies on script block text telemetry from Windows PowerShell logging to identify the presence of these cmdlets within executed scripts.
references:
  - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a
  - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps
  - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_export_certificate.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-04-23
modified: 2023-05-18
tags:
  - attack.credential-access
  - attack.t1552.004
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - Export-PfxCertificate
      - Export-Certificate
  filter_optional_module_export:
    ScriptBlockText|contains: CmdletsToExport = @(
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Legitimate certificate exports by administrators. Additional filters might be required.
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell script blocks that contain certificate export cmdlets, specifically Export-PfxCertificate and Export-Certificate. Exporting certificates from the local store can be used to access or exfiltrate sensitive certificate material, including private keys, from a host. It relies on script block text telemetry from Windows PowerShell logging to identify the presence of these cmdlets within executed scripts.

Known false positives

Legitimate certificate exports by administrators. Additional filters might be required.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.