Suspicious Authentication Certificate and Private-Key Export Activity

Syed Usfar Wasim@nCD24

•updated Aug 12, 2026•7•0•14

This Defender XDR query detects high-confidence attempts to export certificates with private keys using native Windows utilities, PowerShell, Mimikatz, AADInternals, Certipy, OpenSSL, and certificate-management tools.