Suspicious Certificate Exported From Local Certificate Store (via certificateservicesclient-lifecycle-system)

title: Suspicious Certificate Exported From Local Certificate Store (via certificateservicesclient-lifecycle-system)
id: 19006253-df38-53a6-896a-12f59f7972d4
status: stable
description: This rule detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.
references:
    - https://attack.mitre.org/techniques/T1649/
    - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
author: Huntrule Team
date: 2026-04-30
tags:
    - attack.credential-access
    - attack.t1649
logsource:
    product: windows
    service: certificateservicesclient-lifecycle-system
detection:
    selection:
        EventID: 1007
    condition: selection
falsepositives:
    - Unknown
level: medium