PowerShell ScriptBlock Certificate Export via Export-PfxCertificate or Export-Certificate
Detects PowerShell script blocks invoking certificate export cmdlets, which may be abused to steal sensitive certificate material.
- Product
- windows
- Category
- ps_script
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-04-23
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell ScriptBlock content that invokes certificate export cmdlets, specifically Export-PfxCertificate and Export-Certificate, indicating an attempt to export certificates from the local store. Attackers may use this capability to obtain certificate material, including private keys, from compromised hosts. It relies on PowerShell Script Block logging telemetry containing the exported cmdlet names in ScriptBlockText.
Reporting behind it
- us-cert.cisa.govhttps://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps
- splunk.comhttps://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_export_certificate.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell ScriptBlock Certificate Export via Export-PfxCertificate or Export-Certificate
id: 23b426ef-9c65-48ee-bf52-5f70b22c3c64
related:
- id: 9e716b33-63b2-46da-86a4-bd3c3b9b5dfb
type: similar
- id: aa7a3fce-bef5-4311-9cc1-5f04bb8c308c
type: derived
status: test
description: This rule flags PowerShell ScriptBlock content that invokes certificate export cmdlets, specifically Export-PfxCertificate and Export-Certificate, indicating an attempt to export certificates from the local store. Attackers may use this capability to obtain certificate material, including private keys, from compromised hosts. It relies on PowerShell Script Block logging telemetry containing the exported cmdlet names in ScriptBlockText.
references:
- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a
- https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps
- https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_export_certificate.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-04-23
modified: 2023-05-18
tags:
- attack.credential-access
- attack.t1552.004
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains:
- Export-PfxCertificate
- Export-Certificate
filter_optional_module_export:
ScriptBlockText|contains: CmdletsToExport = @(
condition: selection and not 1 of filter_optional_*
falsepositives:
- Legitimate certificate exports by administrators. Additional filters might be required.
level: medium
license: DRL-1.1