CmdID

CmdID / PowerShell / Cmdlets / Export

Export-Certificate

Exports a certificate from a certificate store into a file. Windows Server PowerShell reference

From the Windows Server PowerShell reference 7 parameters 1 Sigma rule looks for it Its page in the reference

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

Parameters

7 in the Windows Server PowerShell reference
-CertSpecifies one or more certificates to be exported to a file.
-Confirm, -cfPrompts you for confirmation before running the cmdlet.
-FilePath, -FullNameSpecifies the location where the exported certificate will be stored.
-ForceSpecifies that the exported certificate file will overwrite an existing certificate file, even if it has the Read-only attribute set.
-NoClobberPrevents an exported certificate file from overwriting an existing certificate file.
-TypeSpecifies the type of output file for the certificate export as follows.
-WhatIf, -wiShows what would happen if the cmdlet runs.

What looks for it

Sigma process creation rules that name Export-Certificate
mediumCertificate Exported Via PowerShellNasreddine Bencherchali (Nextron Systems)