Threat Huntlowtest

PFX File Creation

Detects the creation of PFX files (Personal Information Exchange format). PFX files contain private keys and certificates bundled together, making them valuable targets for attackers seeking to: - Exfiltrate digital certificates for impersonation or signing malicious code - Establish persistent access through certificate-based authentication - Bypass security controls that rely on certificate validation Analysts should investigate PFX file creation events by examining which process created the PFX file and its parent process chain, as well as unusual locations outside standard certificate stores or development environments.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)Created Sat May 02Updated Sun Oct 19dca1b3e8-e043-4ec8-85d7-867f334b5724windows

Hunting Hypothesis

Log Source

WindowsFile Event

ProductWindows← raw: windows

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection:
        TargetFilename|endswith: '.pfx'
    filter_optional_onedrive:
        Image:
            - 'C:\Program Files\Microsoft OneDrive\OneDrive.exe'
            - 'C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe'
        TargetFilename|endswith: '\OneDrive\CodeSigning.pfx'
    filter_optional_visual_studio:
        TargetFilename|startswith:
            - 'C:\Program Files (x86)\Microsoft Visual Studio\'
            - 'C:\Program Files\Microsoft Visual Studio\'
    filter_optional_cmake:
        TargetFilename|startswith: 'C:\Program Files\CMake\'
    condition: selection and not 1 of filter_optional_*