Certificate Exported Via Certutil.EXE
This rule detects the execution of the `certutil.exe` utility specifically when it is used with the `-exportPFX` flag. This flag allows `certutil.exe` to export certificates, potentially including private keys, into a Personal Information Exchange (PFX) file. This activity can be indicative of an adversary attempting to steal credentials or establish persistence by exporting legitimate certificates for later use in impersonation or decryption.
Sigma
