Certificate Exported Via Certutil.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.

Known false positives

There legitimate reasons to export certificates. Investigate the activity to determine if it's benign

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1027` Obfuscated Files or Information

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Certificate Exported Via Certutil.EXE
id: 3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5
status: test
description: Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.
references:
    - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)
date: 2023-02-15
modified: 2024-03-05
tags:
    - attack.stealth
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\certutil.exe'
        - OriginalFileName: 'CertUtil.exe'
    selection_cli:
        CommandLine|contains|windash: '-exportPFX '
    condition: all of selection_*
falsepositives:
    - There legitimate reasons to export certificates. Investigate the activity to determine if it's benign
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_export_pfx/info.yml

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\certutil.exe'
    - OriginalFileName: 'CertUtil.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains|windash: '-exportPFX '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-exportPFX` transforms: `windash`	`field:"CommandLine" kind:match value:"-exportPFX "`
`Image`	ends_with	`\certutil.exe` corpus 44 (sigma 43, kusto 1)	`field:"Image" kind:ends_with value:"\certutil.exe"`
`OriginalFileName`	eq	`CertUtil.exe` corpus 30 (sigma 14, elastic 10, splunk 6)	`field:"OriginalFileName" kind:eq value:"CertUtil.exe"`

Certificate Exported Via Certutil.EXE

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_img

Stage 2: selection_cli

Indicators

Stage 0: `condition`

Stage 1: `selection_img`

Stage 2: `selection_cli`