detection.wiki

Detection rules › Sigma

PFX File Creation

Status
test
Severity
low
Log source
product windows, category file_event
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Source
github.com/SigmaHQ/sigma

Detects the creation of PFX files (Personal Information Exchange format). PFX files contain private keys and certificates bundled together, making them valuable targets for attackers seeking to: - Exfiltrate digital certificates for impersonation or signing malicious code - Establish persistent access through certificate-based authentication - Bypass security controls that rely on certificate validation Analysts should investigate PFX file creation events by examining which process created the PFX file and its parent process chain, as well as unusual locations outside standard certificate stores or development environments.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1552.004 Unsecured Credentials: Private Keys

Event coverage

ProviderEventTitle
SysmonEvent ID 11FileCreate

Rule body yaml

title: PFX File Creation
id: dca1b3e8-e043-4ec8-85d7-867f334b5724
status: test
description: |
    Detects the creation of PFX files (Personal Information Exchange format).
    PFX files contain private keys and certificates bundled together, making them valuable targets for attackers seeking to:

        - Exfiltrate digital certificates for impersonation or signing malicious code
        - Establish persistent access through certificate-based authentication
        - Bypass security controls that rely on certificate validation

    Analysts should investigate PFX file creation events by examining which process created the PFX file and its parent process chain, as well as unusual locations outside standard certificate stores or development environments.
references:
    - https://github.com/OTRF/detection-hackathon-apt29/issues/14
    - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/6.B.1_6392C9F1-D975-4F75-8A70-433DEDD7F622.md
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2020-05-02
modified: 2025-10-19
tags:
    - attack.credential-access
    - attack.t1552.004
    - detection.threat-hunting
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|endswith: '.pfx'
    filter_optional_onedrive:
        Image:
            - 'C:\Program Files\Microsoft OneDrive\OneDrive.exe'
            - 'C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe'
        TargetFilename|endswith: '\OneDrive\CodeSigning.pfx'
    filter_optional_visual_studio:
        TargetFilename|startswith:
            - 'C:\Program Files (x86)\Microsoft Visual Studio\'
            - 'C:\Program Files\Microsoft Visual Studio\'
    filter_optional_cmake:
        TargetFilename|startswith: 'C:\Program Files\CMake\'
    condition: selection and not 1 of filter_optional_*
falsepositives:
    - System administrators legitimately managing certificates and PKI infrastructure
    - Development environments where developers create test certificates for application signing
    - Automated certificate deployment tools and scripts used in enterprise environments
    - Software installation processes that include certificate provisioning (e.g., web servers, VPN clients)
    - Certificate backup and recovery operations performed by IT staff
    - Build systems and CI/CD pipelines that generate code signing certificates
    - Third-party applications that create temporary certificates for secure communications
level: low

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_optional_*

Stage 1: selection

selection:
    TargetFilename|endswith: '.pfx'

Stage 2: not filter_optional_*

filter_optional_onedrive:
    Image:
        - 'C:\Program Files\Microsoft OneDrive\OneDrive.exe'
        - 'C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe'
    TargetFilename|endswith: '\OneDrive\CodeSigning.pfx'
filter_optional_visual_studio:
    TargetFilename|startswith:
        - 'C:\Program Files (x86)\Microsoft Visual Studio\'
        - 'C:\Program Files\Microsoft Visual Studio\'
filter_optional_cmake:
    TargetFilename|startswith: 'C:\Program Files\CMake\'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
ImageeqC:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe
ImageeqC:\Program Files\Microsoft OneDrive\OneDrive.exe
TargetFilenameends_with\OneDrive\CodeSigning.pfx
TargetFilenamestarts_withC:\Program Files (x86)\Microsoft Visual Studio\
TargetFilenamestarts_withC:\Program Files\CMake\
TargetFilenamestarts_withC:\Program Files\Microsoft Visual Studio\

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetFilenameends_with
  • .pfx corpus 2 (sigma 2)