huntrule

Windows Private Key File Recon via cmd.exe, PowerShell, or findstr.exe

Flags Windows command-line searches for key/certificate file extensions using cmd.exe, PowerShell, or findstr.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-07-20
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Windows process activity that combines command-line file discovery with searches for private key and certificate-related file extensions. Attackers often enumerate locally stored keys to find credentials for later access or impersonation, making this reconnaissance behavior high risk. The detection relies on Windows process creation telemetry, matching the command line for key/certificate extensions and common directory/listing or PowerShell enumeration or findstr usage.

Reporting behind it

Related detections9 linkedT1552.004 — drag to rearrange
Suspicious Process Memory Read from Proc Mem for Secret Extraction
Suspicious Double Base64 Decoded Payload Piped to Shell in CI (reviewdog Supply Chain)
Suspicious Object Access to DPAPI Machine Keys and System Protect Directories (via security)
Suspicious macOS Local Credential Validation via dscl authonly
Suspicious Credential File Harvesting of NPM Claude and SSH Secrets
Suspicious SharpDPAPI Machine Masterkey Extraction (via process_creation)
Suspicious Credential File Discovery via Find on Linux
Possible CI Runner Memory Scraping via Python Process Memory Read (tj-actions Supply Chain)
Windows File Writes Matching DPAPI Backup Key and Certificate Export Filenames
Windows Private Key File Recon via cmd.exe, PowerShell, or findstr.exe
Pivot detection · T1552.004 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.