Query: alert when Adversaries may search for private key certificate files on compromised systems for insecurely stored credential
Matching passage: Sigma rule: Adversaries may search for private key certificate files on compromised systems for insecurely stored credential. Logsource: windows / process_creation. Rule: title: Private Keys Reconnaissance Via CommandLine Tools id: 213d6a77-3d55-4ce8-ba74-fcfef741974e status: test description: Adversaries may search for private key certificate files on compromised systems for insecurely stored credential references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.004/T1552.004.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-07-20 modified: 2023-03-06 tags: - attack.credential-access - attack.t1552.004 logsource: category: process_creation product: windows detection: selection_cmd_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cmd_cli: CommandLine|contains: 'dir ' selection_pwsh_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_pwsh_cli: CommandLine|contains: 'Get-ChildItem ' selection_findstr: - Image|endswith: \findstr.exe - OriginalFileName: FINDSTR.EXE selection_ext: CommandLine|contains: - .key - .pgp - .gpg - .ppk - .p12 - .pem - .pfx - .cer - .p7b - .asc condition: selection_ext and (all of selection_cmd_* or all of selection_pwsh_* or selection_findstr) falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript,. Logsource: windows / registry_event. Rule: title: Registry Tampering by Potentially Suspicious Processes id: 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2 related: - id: 2a0a169d-cc66-43ce-9ae2-6e678e54e46a type: similar - id: 921aa10f-2e74-4cca-9498-98f9ca4d6fdf type: similar status: experimental description: 'Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc. These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence. ' references: - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/ - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-08-13 modified: 2026-04-14 tags: - attack.persistence - attack.execution - attack.defense-impairment - attack.t1112 - attack.t1059.005 logsource: category: registry_event product: windows detection: selection: Image|endswith: - \mshta.exe - \wscript.exe - \cscript.exe filter_main_binary_data: Details: Binary Data filter_main_null: Details: null filter_main_wscript_legit_1: Image|endswith: \wscript.exe TargetObject|contains: - SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\ - \Services\bam\State\UserSettings\S-1- - Software\Microsoft\Windows Script\Settings\Telemetry\wscript.exe\ - Software\Microsoft\Windows\CurrentVersion\Internet Settings\ filter_main_wscript_legit_2: Image|endswith: \wscript.exe TargetObject|contains: \wscript.exe condition: selection and not 1 of filter_main_* falsepositives: - Some legitimate admin or install scripts may use these processes for registry modifications. level: medium