Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Certificate Exported Via Certutil.EXE

Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)Created Wed Feb 15Updated Tue Mar 053ffd6f51-e6c1-47b7-94b4-c1e61d4117c5windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic2 selectors
detection:
    selection_img:
        - Image|endswith: '\certutil.exe'
        - OriginalFileName: 'CertUtil.exe'
    selection_cli:
        CommandLine|contains|windash: '-exportPFX '
    condition: all of selection_*
False Positives

There legitimate reasons to export certificates. Investigate the activity to determine if it's benign

References
1
Resolving title…
splunk.com
Testing & Validation

Regression Tests

by SigmaHQ Team
Positive Detection Test1 matchevtx

Microsoft-Windows-Sysmon

EVTX JSON
MITRE ATT&CK
Rule Metadata
Rule ID
3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5
Status
test
Level
medium
Type
Detection
Created
Wed Feb 15
Modified
Tue Mar 05
Author
Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Path
rules/windows/process_creation/proc_creation_win_certutil_export_pfx.yml
Raw Tags
attack.defense-evasionattack.t1027
View on GitHub