splApache-2.0from splunk/security_content

Certutil exe certificate extraction

The following analytic identifies the use of certutil.exe with arguments indicating the manipulation or extraction of certificates. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because extracting certificates can allow attackers to sign new authentication tokens, particularly in federated environments like Windows ADFS. If confirmed malicious, this could enable attackers to forge authentication tokens, potentially leading to unauthorized access and privilege escalation within the network.

Quality

FP risk

—

Forks

Views

Rule sourcedetections/endpoint/certutil_exe_certificate_extraction.yml

| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime
FROM datamodel=Endpoint.Processes
WHERE
(
    Processes.process_name=certutil.exe
    OR
    Processes.original_file_name=certutil.exe
)
Processes.process = "*-exportPFX*"

BY Processes.action Processes.dest Processes.original_file_name
   Processes.parent_process Processes.parent_process_exec
   Processes.parent_process_guid Processes.parent_process_id
   Processes.parent_process_name Processes.parent_process_path
   Processes.process Processes.process_exec Processes.process_guid
   Processes.process_hash Processes.process_id Processes.process_integrity_level
   Processes.process_name Processes.process_path Processes.user
   Processes.user_id Processes.vendor_product

| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `certutil_exe_certificate_extraction_filter`