Certificate Export via PowerShell Cmdlets

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

Detects calls to PowerShell cmdlets used to export certificates from the local certificate store. Threat actors have been observed abusing this technique to steal private keys from compromised machines, which can then be used for authentication or decryption.