huntrule

Windows CAPI2 Event 70: Certificate Private Key Acquired

Detects when Windows CAPI2 logs that a process acquired a certificate private key (EventID 70).

FreeReviewedSigma · Medium · v2
Product
windows
Service
capi2
Author
Zach Mathis (SigmaHQ), DRL 1.1
Published
2023-05-13
Updated
2026-07-31
AnalysisDetection
title: "Windows CAPI2 Event 70: Certificate Private Key Acquired"
id: 66015db3-8fe8-4e38-9d99-75b90763070c
status: test
description: This rule flags CAPI2 Operational events where an application acquires (exports) a certificate private key. Attackers may seek private keys to impersonate identities, decrypt protected content, or facilitate further credential access. It relies on Windows CAPI2 Operational logging (EventID 70) indicating certificate private key acquisition.
references:
  - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/capi2/win_capi2_acquire_certificate_private_key.yml
author: Zach Mathis, Huntrule Team
date: 2023-05-13
tags:
  - attack.credential-access
  - attack.t1649
logsource:
  product: windows
  service: capi2
  definition: "Requirements: The CAPI2 Operational log needs to be enabled"
detection:
  selection:
    EventID: 70
  condition: selection
falsepositives:
  - Legitimate application requesting certificate exports will trigger this. Apply additional filters as needed
level: medium
license: DRL-1.1
related:
  - id: e2b5163d-7deb-4566-9af3-40afea6858c3
    type: derived