Suspicious Certificate Exported Through PowerShell - ScriptBlock (via ps_script)

title: Suspicious Certificate Exported Through PowerShell - ScriptBlock (via ps_script)
id: 0f7b7315-023c-5309-b3a0-4aa60f2897fa
status: stable
description: This rule detects calls to cmdlets inside of PowerShell scripts that are leveraged to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.
references:
    - https://attack.mitre.org/techniques/T1552/004/
    - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a
    - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps
    - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
author: Huntrule Team
date: 2026-03-29
tags:
    - attack.credential-access
    - attack.t1552.004
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains:
            - 'Export-PfxCertificate'
            - 'Export-Certificate'
    filter_optional_module_export:
        ScriptBlockText|contains: 'CmdletsToExport = @('
    condition: selection and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium