CmdID

CmdID / Techniques / T1552

T1552.004 Unsecured Credentials: Private Keys

Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. MITRE ATT&CK

3 Sigma rules T1552.004 on attack.mitre.org

Part of

MITRE ATT&CK
T1552Unsecured Credentials

Sigma rules tagged with it

process creation, the highest levels first
highPowerShell Get-Process LSASSFlorian Roth (Nextron Systems) · Windows
mediumCertificate Exported Via PowerShellNasreddine Bencherchali (Nextron Systems) · Windows
mediumPrivate Keys Reconnaissance Via CommandLine Toolsfrack113, Nasreddine Bencherchali (Nextron Systems) · Windows