Procedure examples

Machete has scanned and looked for cryptographic keys and certificate file extensions.

Mafalda can collect a Chrome encryption key used to protect browser cookies.

Hildegard has searched for private keys in .ssh.

FoggyWeb can retrieve token signing certificates and token decryption certificates from a compromised AD FS server.

Troll Stealer collects all data in victim `.ssh` folders by creating a compressed copy that is subsequently exfiltrated to command and control infrastructure. Troll Stealer also collects key information associated with the Government Public Key Infrastructure (GPKI) service for South Korean government information systems.

Ebury has intercepted unencrypted private keys as well as private key pass-phrases.

Kinsing has searched for private keys.

jRAT can steal keys for VPNs and cryptocurrency wallets.

AADInternals can gather encryption keys from Azure AD services such as ADSync and Active Directory Federated Services servers.

Empire can use modules like Invoke-SessionGopher to extract private key and session information.

Mimikatz's CRYPTO::Extract module can extract keys by interacting with Windows cryptographic application programming interface (API) functions.

TeamPCP Cloud Stealer has searched victim hosts for TLS and SSH keys.

Mini Shai-Hulud has gathered unsecured credentials to include SSH private keys within .ssh.

CanisterWorm has gathered SSH private keys from the .ssh file.