Title:Certificate Exported Via Certutil.EXE Status:test Description:Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates. References: -https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) Date: 2023-02-15 modified:2024-03-05 Tags:
-'attack.stealth'
-'attack.t1027'
Logsource:
category: process_creation
product: windows
Detection: selection_img: Image|endswith:'\certutil.exe'OriginalFileName:'CertUtil.exe'selection_cli: CommandLine|contains|windash:
'-exportPFX ' condition:all of selection_* Falsepositives:
-There legitimate reasons to export certificates. Investigate the activity to determine if it's benign Level:medium
