Windows PFX File Creation From File Events

Flags Windows file events where a .pfx (certificate + private key) is created, excluding a few common benign locations.

FreeReviewedSigma · Low · v5

Product: windows
Category: file_event
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) (SigmaHQ), DRL 1.1
Published: 2020-05-02
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1552.004Private Keys
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies creation of Personal Information Exchange (PFX) files by matching file events where the target filename ends with .pfx. Because PFX files bundle private keys and certificates, their creation can indicate attempts to collect credentials for impersonation or signing, or to stage certificate-based access. The detection relies on Windows file event telemetry and uses exclusion filters for common benign locations and tooling-related PFX generation (such as OneDrive CodeSigning.pfx, Visual Studio, and CMake paths).

Reporting behind it

Related detections9 linkedT1552.004 — drag to rearrange

Suspicious Process Memory Read from Proc Mem for Secret Extraction

Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)

Suspicious Object Access to DPAPI Machine Keys and System Protect Directories (via security)

Suspicious macOS Local Credential Validation via dscl authonly

Suspicious Credential File Harvesting of NPM Claude and SSH Secrets

Suspicious SharpDPAPI Machine Masterkey Extraction (via process_creation)

Suspicious Credential File Discovery via Find on Linux

Possible CI Runner Memory Scraping via Python Process Memory Read (tj-actions Supply Chain)

Windows File Writes Matching DPAPI Backup Key and Certificate Export Filenames

Windows PFX File Creation From File Events

Pivot detection · T1552.004 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-pfx-file-creation-via-file-write-events-dca1b3e8

title: Windows PFX File Creation From File Events
id: 243aff18-74ca-4c33-a615-ee5fe46fc43b
status: test
description: This rule identifies creation of Personal Information Exchange (PFX) files by matching file events where the target filename ends with .pfx. Because PFX files bundle private keys and certificates, their creation can indicate attempts to collect credentials for impersonation or signing, or to stage certificate-based access. The detection relies on Windows file event telemetry and uses exclusion filters for common benign locations and tooling-related PFX generation (such as OneDrive CodeSigning.pfx, Visual Studio, and CMake paths).
references:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/14
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/6.B.1_6392C9F1-D975-4F75-8A70-433DEDD7F622.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_event/file_event_win_pfx_file_creation.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-05-02
modified: 2025-10-19
tags:
  - attack.credential-access
  - attack.t1552.004
  - detection.threat-hunting
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith: .pfx
  filter_optional_onedrive:
    Image:
      - C:\Program Files\Microsoft OneDrive\OneDrive.exe
      - C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe
    TargetFilename|endswith: \OneDrive\CodeSigning.pfx
  filter_optional_visual_studio:
    TargetFilename|startswith:
      - C:\Program Files (x86)\Microsoft Visual Studio\
      - C:\Program Files\Microsoft Visual Studio\
  filter_optional_cmake:
    TargetFilename|startswith: C:\Program Files\CMake\
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - System administrators legitimately managing certificates and PKI infrastructure
  - Development environments where developers create test certificates for application signing
  - Automated certificate deployment tools and scripts used in enterprise environments
  - Software installation processes that include certificate provisioning (e.g., web servers, VPN clients)
  - Certificate backup and recovery operations performed by IT staff
  - Build systems and CI/CD pipelines that generate code signing certificates
  - Third-party applications that create temporary certificates for secure communications
level: low
license: DRL-1.1
related:
  - id: dca1b3e8-e043-4ec8-85d7-867f334b5724
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL