Suspicious PFX File Creation

Title: Suspicious PFX File Creation
Status: test
Description:A general detection for processes creating PFX files. This could be an indicator of an adversary exporting a local certificate to a PFX file.
References:
  -https://github.com/OTRF/detection-hackathon-apt29/issues/14
  -https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/6.B.1_6392C9F1-D975-4F75-8A70-433DEDD7F622.md
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
modified:2022-07-07
Tags:

• -'attack.credential-access'
• -'attack.t1552.004'

Logsource:

• product: windows
• category: file_event

Detection:
  selection:
    TargetFilename|endswith: '.pfx'
  filter_main_windows_tmp_key:
    TargetFilename|contains|all:
      -'\Templates\Windows\Windows_TemporaryKey.pfx'
      -'\CMake\'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -System administrators managing certificates.
Level: medium