Certificate Exported Via PowerShell ScriptBlock

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

Detects PowerShell script blocks that contain commands used to export certificates from the local certificate store. This activity can be abused by threat actors to steal private keys from compromised machines.