huntrule

PowerShell ScriptBlock Certificate Export via Export-PfxCertificate or Export-Certificate

Detects PowerShell script blocks invoking certificate export cmdlets, which may be abused to steal sensitive certificate material.

FreeReviewedSigma · Medium · v2
Product
windows
Category
ps_script
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-04-23
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags PowerShell ScriptBlock content that invokes certificate export cmdlets, specifically Export-PfxCertificate and Export-Certificate, indicating an attempt to export certificates from the local store. Attackers may use this capability to obtain certificate material, including private keys, from compromised hosts. It relies on PowerShell Script Block logging telemetry containing the exported cmdlet names in ScriptBlockText.

Reporting behind it

Related detections9 linkedT1552.004 — drag to rearrange
Suspicious Process Memory Read from Proc Mem for Secret Extraction
Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)
Suspicious Object Access to DPAPI Machine Keys and System Protect Directories (via security)
Suspicious macOS Local Credential Validation via dscl authonly
Suspicious Credential File Harvesting of NPM Claude and SSH Secrets
Suspicious SharpDPAPI Machine Masterkey Extraction (via process_creation)
Suspicious Credential File Discovery via Find on Linux
Possible CI Runner Memory Scraping via Python Process Memory Read (tj-actions Supply Chain)
Windows File Writes Matching DPAPI Backup Key and Certificate Export Filenames
PowerShell ScriptBlock Certificate Export via Export-PfxCertificate or Export-Certificate
Pivot detection · T1552.004 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.