Windows Certificate Services Client: Exported Certificate from Local Store

Flags Windows events where a certificate is exported from the local certificate store via Certificate Services client telemetry.

FreeUnreviewedSigmamediumv1

windows-certificate-services-client-exported-certificate-from-local-store-58c0bff0

title: "Windows Certificate Services Client: Exported Certificate from Local Store"
id: 4875024a-2a70-4f4e-9e56-38bebe3dbcd3
status: test
description: This rule alerts when the Windows Certificate Services client lifecycle logs indicate a certificate was exported from the local certificate store. Exported certificates may be used to impersonate services or, in some cases, to access associated private key material. The detection relies on Windows event telemetry from the certificateservicesclient-lifecycle-system service, specifically EventID 1007 indicating certificate export activity.
references:
  - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/certificate_services_client_lifecycle_system/win_certificateservicesclient_lifecycle_system_cert_exported.yml
author: Zach Mathis, Huntrule Team
date: 2023-05-13
tags:
  - attack.credential-access
  - attack.t1649
logsource:
  product: windows
  service: certificateservicesclient-lifecycle-system
detection:
  selection:
    EventID: 1007
  condition: selection
falsepositives:
  - Legitimate application requesting certificate exports will trigger this. Apply additional filters as needed
level: medium
license: DRL-1.1
related:
  - id: 58c0bff0-40a0-46e8-b5e8-b734b84d2017
    type: derived

What it detects

This rule alerts when the Windows Certificate Services client lifecycle logs indicate a certificate was exported from the local certificate store. Exported certificates may be used to impersonate services or, in some cases, to access associated private key material. The detection relies on Windows event telemetry from the certificateservicesclient-lifecycle-system service, specifically EventID 1007 indicating certificate export activity.

Known false positives

Legitimate application requesting certificate exports will trigger this. Apply additional filters as needed

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.