detection.wiki

Detection rules › Splunk

Windows Export Certificate

Status
production
Severity
low
Group by
SubjectName, UserData_Xml, computer_name
Author
Michael Haag, Splunk
Source
github.com/splunk/security_content

The following analytic detects the export of a certificate from the Windows Certificate Store. It leverages the Certificates Lifecycle log channel, specifically event ID 1007, to identify this activity. Monitoring certificate exports is crucial as certificates can be used for authentication to VPNs or private resources. If malicious actors export certificates, they could potentially gain unauthorized access to sensitive systems or data, leading to significant security breaches.

Known false positives

  • False positives may be generated based on an automated process or service that exports certificates on the regular. Review is required before setting to alert. Monitor for abnormal processes performing an export.

MITRE ATT&CK coverage

TacticTechniques
Credential Access

Telemetry coverage

ProviderRecord / event type
CertificateServicesClient-Lifecycle-SystemEvent ID 1007: A certificate has been exported.

Rule body

name: Windows Export Certificate
id: d8ddfa9b-b724-4df9-9dbe-f34cc0936714
version: 11
creation_date: '2023-02-03'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic detects the export of a certificate from the Windows Certificate Store. It leverages the Certificates Lifecycle log channel, specifically event ID 1007, to identify this activity. Monitoring certificate exports is crucial as certificates can be used for authentication to VPNs or private resources. If malicious actors export certificates, they could potentially gain unauthorized access to sensitive systems or data, leading to significant security breaches.
data_source:
    - Windows Event Log CertificateServicesClient 1007
search: |-
    `certificateservices_lifecycle` EventCode=1007
      | xmlkv UserData_Xml
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY Computer, SubjectName, UserData_Xml
      | rename Computer as dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_export_certificate_filter`
how_to_implement: To implement this analytic, you must collect Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational or Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational.
known_false_positives: False positives may be generated based on an automated process or service that exports certificates on the regular. Review is required before setting to alert. Monitor for abnormal processes performing an export.
references:
    - https://atomicredteam.io/defense-evasion/T1553.004/#atomic-test-4---install-root-ca-on-windows
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: An certificate was exported on $dest$ from the Windows Certificate Store.
analytic_story:
    - Windows Certificate Services
asset_type: Endpoint
mitre_attack_id:
    - T1552.004
    - T1649
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

Stages and Predicates

Stage 1: search

`certificateservices_lifecycle` EventCode=1007

Stage 2: xmlkv

| xmlkv UserData_Xml

Stage 3: stats

| stats count min(_time) as firstTime max(_time) as lastTime
    BY Computer, SubjectName, UserData_Xml

Stage 4: rename

| rename Computer as dest

Stage 5: search

| `security_content_ctime(firstTime)`

Stage 6: search

| `security_content_ctime(lastTime)`

Stage 7: search

| `windows_export_certificate_filter`

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
EventCodeeq
  • 1007
field:"EventID" kind:eq value:"1007"