Query: Sigma rule for Adversaries may search for private key certificate files on compromised systems for insecurely stored credential
Matching passage: Sigma rule: Adversaries may search for private key certificate files on compromised systems for insecurely stored credential. Logsource: windows / process_creation. Rule: title: Private Keys Reconnaissance Via CommandLine Tools id: 213d6a77-3d55-4ce8-ba74-fcfef741974e status: test description: Adversaries may search for private key certificate files on compromised systems for insecurely stored credential references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.004/T1552.004.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-07-20 modified: 2023-03-06 tags: - attack.credential-access - attack.t1552.004 logsource: category: process_creation product: windows detection: selection_cmd_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cmd_cli: CommandLine|contains: 'dir ' selection_pwsh_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_pwsh_cli: CommandLine|contains: 'Get-ChildItem ' selection_findstr: - Image|endswith: \findstr.exe - OriginalFileName: FINDSTR.EXE selection_ext: CommandLine|contains: - .key - .pgp - .gpg - .ppk - .p12 - .pem - .pfx - .cer - .p7b - .asc condition: selection_ext and (all of selection_cmd_* or all of selection_pwsh_* or selection_findstr) falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/writ. Logsource: windows / image_load. Rule: title: Potentially Suspicious Image Load of Offreg.dll id: c9e5f013-4a6f-4d8c-9b0e-f7a4c3d26e95 status: experimental description: 'Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API, bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives while evading detection mechanisms that rely on standard registry event logs. ' references: - https://learn.microsoft.com/en-us/windows/win32/devnotes/about-the-offline-registry-library - https://github.com/MSNightmare/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.defense-impairment - attack.persistence - attack.t1112 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \offreg.dll filter_main_system32: Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_main_program_files: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_main_appdata_local_programs: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Programs\ filter_main_defender: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\ Image|endswith: \MsMpEng.exe condition: selection and not 1 of filter_main_* falsepositives: - Third-party backup or forensic software that performs offline registry parsing - Windows deployment tools (DISM, ADK) run from non-standard paths level: medium regression_tests_path: regression_data/rules/windows/image_load/image_load_susp_offreg_dll_load/info.yml