ID | Technique | Tactic |
---|---|---|
T1552.004 | Private Keys | Credential Access |
T1552 | Unsecured Credentials | Credential Access |
T1649 | Steal or Forge Authentication Certificates | Credential Access |
Detection: Windows Export Certificate
Description
The following analytic detects the export of a certificate from the Windows Certificate Store. It leverages the Certificates Lifecycle log channel, specifically event ID 1007, to identify this activity. Monitoring certificate exports is crucial as certificates can be used for authentication to VPNs or private resources. If malicious actors export certificates, they could potentially gain unauthorized access to sensitive systems or data, leading to significant security breaches.
Search
1`certificateservices_lifecycle` EventCode=1007
2| xmlkv UserData_Xml
3| stats count min(_time) as firstTime max(_time) as lastTime by Computer, SubjectName, UserData_Xml
4| rename Computer as dest
5| `security_content_ctime(firstTime)`
6| `security_content_ctime(lastTime)`
7| `windows_export_certificate_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
Windows Event Log CertificateServicesClient 1007 | Windows | 'XmlWinEventLog' |
'XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational' |
N/A |
Macros Used
Name | Value |
---|---|
certificateservices_lifecycle | (source=XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational OR source=XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational) |
windows_export_certificate_filter | search * |
windows_export_certificate_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Risk Event | True |
Implementation
To implement this analytic, you must collect Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational or Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational.
Known False Positives
False positives may be generated based on an automated process or service that exports certificates on the regular. Review is required before setting to alert. Monitor for abnormal processes performing an export.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
An certificate was exported on $dest$ from the Windows Certificate Store. | 36 | 60 | 60 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational |
XmlWinEventLog |
Integration | ✅ Passing | Dataset | XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational |
XmlWinEventLog |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 3