Windows Certificate Export from Local Certificate Store (Event ID 1007)
Flags Windows events where a certificate is exported from the local certificate store via Certificate Services client telemetry.
- Product
- windows
- Service
- certificateservicesclient-lifecycle-system
- Author
- Zach Mathis (SigmaHQ), DRL 1.1
- Published
- 2023-05-13
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies when an application exports a certificate from the local Windows certificate store. Certificate export can enable attackers to move trust material, and in some cases may include private key material, supporting credential access and persistence. The detection relies on Windows certificate services client lifecycle telemetry reporting Event ID 1007 for certificate export activity.
Reporting behind it
- splunk.comhttps://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/certificate_services_client_lifecycle_system/win_certificateservicesclient_lifecycle_system_cert_exported.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Certificate Export from Local Certificate Store (Event ID 1007)
id: 4875024a-2a70-4f4e-9e56-38bebe3dbcd3
status: test
description: This rule identifies when an application exports a certificate from the local Windows certificate store. Certificate export can enable attackers to move trust material, and in some cases may include private key material, supporting credential access and persistence. The detection relies on Windows certificate services client lifecycle telemetry reporting Event ID 1007 for certificate export activity.
references:
- https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/certificate_services_client_lifecycle_system/win_certificateservicesclient_lifecycle_system_cert_exported.yml
author: Zach Mathis, Huntrule Team
date: 2023-05-13
tags:
- attack.credential-access
- attack.t1649
logsource:
product: windows
service: certificateservicesclient-lifecycle-system
detection:
selection:
EventID: 1007
condition: selection
falsepositives:
- Legitimate application requesting certificate exports will trigger this. Apply additional filters as needed
level: medium
license: DRL-1.1
related:
- id: 58c0bff0-40a0-46e8-b5e8-b734b84d2017
type: derived