A user created a pfx file for the first time

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-09-24

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules	Identity Analytics
Detector Tags
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Unsecured Credentials: Credentials In Files (T1552.001)
Severity	Informational

A user created a pfx file for the first time.

Attackers may export certificates to pfx files to use them for authentication, persistence or NTLM extraction.

Check if the pfx creation is legitimate for the user (testing, IT, etc.).
Follow further actions done by the user (ex. authentication using certificates).

ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Unsecured Credentials: Credentials In Files (T1552.001)
Severity	Low

A user created a pfx in a suspicious folder which is publicly accessible, for the first time.

Attackers may export certificates to pfx files to use them for authentication, persistence or NTLM extraction.

Check if the pfx creation is legitimate for the user (testing, IT, etc.).
Follow further actions done by the user (ex. authentication using certificates).