Windows: certutil.exe certificate export using -exportPFX

Flags certutil.exe executions on Windows that include the -exportPFX argument to export certificate material.

FreeUnreviewedSigmamediumv1

windows-certutil-exe-certificate-export-using-exportpfx-3ffd6f51

title: "Windows: certutil.exe certificate export using -exportPFX"
id: 4fb2a146-0b8f-4ec5-ab43-8e99ef085231
status: test
description: This rule matches process creation events where certutil.exe is executed with the -exportPFX flag, which enables exporting certificates in PFX format. Attackers can use this capability to obtain or move certificate material for further access, persistence, or stealthy activity. Telemetry relies on Windows process creation fields that include the executed image and the command line containing the -exportPFX parameter.
references:
  - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_certutil_export_pfx.yml
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-15
modified: 2024-03-05
tags:
  - attack.stealth
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \certutil.exe
    - OriginalFileName: CertUtil.exe
  selection_cli:
    CommandLine|contains|windash: "-exportPFX "
  condition: all of selection_*
falsepositives:
  - There legitimate reasons to export certificates. Investigate the activity to determine if it's benign
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_export_pfx/info.yml
license: DRL-1.1
related:
  - id: 3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5
    type: derived

What it detects

This rule matches process creation events where certutil.exe is executed with the -exportPFX flag, which enables exporting certificates in PFX format. Attackers can use this capability to obtain or move certificate material for further access, persistence, or stealthy activity. Telemetry relies on Windows process creation fields that include the executed image and the command line containing the -exportPFX parameter.

Known false positives

There legitimate reasons to export certificates. Investigate the activity to determine if it's benign

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.