ssa___windows_powershell_export_certificate.yml

name: Windows PowerShell Export Certificate
id: 0bf87e10-4d7d-4c63-9721-c7b3f6e6e944
version: 3
date: '2023-05-01'
author: Michael Haag, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies the PowerShell Cmdlet export-certificate
  utilizing Script Block Logging. This particular behavior is related to an adversary
  attempting to steal certificates local to the Windows endpoint within the Certificate
  Store.
data_source:
- Powershell 4104
search:
  selection1:
    process.cmd_line|re: 'export-certificate'
  condition: (selection1)
how_to_implement: To successfully implement this analytic, you will need to enable
  PowerShell Script Block Logging on some or all endpoints. Additional setup here
  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: It is possible administrators or scripts may run these commands,
  filtering may be required.
references:
- https://dev.to/iamthecarisma/managing-windows-pfx-certificates-through-powershell-3pj
- https://learn.microsoft.com/en-us/powershell/module/pki/export-certificate?view=windowsserver2022-ps
tags:
  analytic_story:
  - Windows Certificate Services
  asset_type: Endpoint
  confidence: 60
  impact: 60
  message: A PowerShell Cmdlet related to exporting a Certificate was ran on $dest_device_id$,
    attempting to export a certificate.
  mitre_attack_id:
  - T1552.004
  - T1552
  - T1649
  observable:
  - name: dest_device_id
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Behavioral Analytics
  required_fields:
  - _time
  - dest_device_id
  - process_name
  - parent_process_name
  - process_path
  - dest_user_id
  - process
  - process
  kill_chain_phases:
  - Exploitation
  risk_score: 36
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log
    source: XmlWinEventLog
    sourcetype: XmlWinEventLog
    update_timestamp: true