Certificate Exported Via PowerShell - ScriptBlock

Status: test
Severity: medium
Log source: category ps_script, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

Known false positives

Legitimate certificate exports by administrators. Additional filters might be required.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1552.004` Unsecured Credentials: Private Keys

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

title: Certificate Exported Via PowerShell - ScriptBlock
id: aa7a3fce-bef5-4311-9cc1-5f04bb8c308c
related:
    - id: 9e716b33-63b2-46da-86a4-bd3c3b9b5dfb
      type: similar
status: test
description: Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.
references:
    - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a
    - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps
    - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
author: Florian Roth (Nextron Systems)
date: 2021-04-23
modified: 2023-05-18
tags:
    - attack.credential-access
    - attack.t1552.004
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains:
            - 'Export-PfxCertificate'
            - 'Export-Certificate'
    filter_optional_module_export:
        ScriptBlockText|contains: 'CmdletsToExport = @('
    condition: selection and not 1 of filter_optional_*
falsepositives:
    - Legitimate certificate exports by administrators. Additional filters might be required.
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_optional_*

Stage 1: `selection`

selection:
    ScriptBlockText|contains:
        - 'Export-PfxCertificate'
        - 'Export-Certificate'

Stage 2: `not filter_optional_module_export`

filter_optional_module_export:
    ScriptBlockText|contains: 'CmdletsToExport = @('

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`ScriptBlockText`	match	`CmdletsToExport = @(`	`excludes:ScriptBlockText` `field:"ScriptBlockText" value:"CmdletsToExport = @("`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ScriptBlockText`	match	`Export-Certificate` corpus 2 (sigma 1, splunk 1) `Export-PfxCertificate` corpus 2 (sigma 1, splunk 1)	`field:"ScriptBlockText" kind:match`