All Detections

Certificate Exported Via Certutil.EXE

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 2025016

Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.

Sigma