Windows Private Key File Recon via cmd.exe, PowerShell, or findstr.exe

title: Windows Private Key File Recon via cmd.exe, PowerShell, or findstr.exe
id: 07642b14-b6a9-4526-a96a-846fef7f6916
status: test
description: This rule identifies Windows process activity that combines command-line file discovery with searches for private key and certificate-related file extensions. Attackers often enumerate locally stored keys to find credentials for later access or impersonation, making this reconnaissance behavior high risk. The detection relies on Windows process creation telemetry, matching the command line for key/certificate extensions and common directory/listing or PowerShell enumeration or findstr usage.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.004/T1552.004.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_private_keys_recon.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-07-20
modified: 2023-03-06
tags:
  - attack.credential-access
  - attack.t1552.004
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd_img:
    - Image|endswith: \cmd.exe
    - OriginalFileName: Cmd.Exe
  selection_cmd_cli:
    CommandLine|contains: "dir "
  selection_pwsh_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_pwsh_cli:
    CommandLine|contains: "Get-ChildItem "
  selection_findstr:
    - Image|endswith: \findstr.exe
    - OriginalFileName: FINDSTR.EXE
  selection_ext:
    CommandLine|contains:
      - .key
      - .pgp
      - .gpg
      - .ppk
      - .p12
      - .pem
      - .pfx
      - .cer
      - .p7b
      - .asc
  condition: selection_ext and (all of selection_cmd_* or all of selection_pwsh_* or selection_findstr)
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 213d6a77-3d55-4ce8-ba74-fcfef741974e
    type: derived