Windows CAPI2 Acquire Certificate Private Key EventID 70

Detects when Windows CAPI2 logs that a process acquired a certificate private key (EventID 70).

FreeUnreviewedSigmamediumv1

windows-capi2-acquire-certificate-private-key-eventid-70-e2b5163d

title: Windows CAPI2 Acquire Certificate Private Key EventID 70
id: 66015db3-8fe8-4e38-9d99-75b90763070c
status: test
description: This rule flags Windows CAPI2 events where a process acquires a certificate private key (EventID 70). Attackers may use stolen or newly acquired private keys to enable certificate-based impersonation, decrypt protected content, or persist access. It relies on CAPI2 Operational logging telemetry that records certificate private key acquisition activity.
references:
  - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/capi2/win_capi2_acquire_certificate_private_key.yml
author: Zach Mathis, Huntrule Team
date: 2023-05-13
tags:
  - attack.credential-access
  - attack.t1649
logsource:
  product: windows
  service: capi2
  definition: "Requirements: The CAPI2 Operational log needs to be enabled"
detection:
  selection:
    EventID: 70
  condition: selection
falsepositives:
  - Legitimate application requesting certificate exports will trigger this. Apply additional filters as needed
level: medium
license: DRL-1.1
related:
  - id: e2b5163d-7deb-4566-9af3-40afea6858c3
    type: derived

What it detects

This rule flags Windows CAPI2 events where a process acquires a certificate private key (EventID 70). Attackers may use stolen or newly acquired private keys to enable certificate-based impersonation, decrypt protected content, or persist access. It relies on CAPI2 Operational logging telemetry that records certificate private key acquisition activity.

Known false positives

Legitimate application requesting certificate exports will trigger this. Apply additional filters as needed

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.