Certificate Exported From Local Certificate Store
Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store. This activity can be indicative of an adversary attempting to steal authentication certificates for various malicious purposes, including lateral movement, persistence, or privilege escalation.
Sigma
