PowerShell pfx certificate extraction

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Unsecured Credentials: Credentials In Files (T1552.001)
Severity	Informational

PowerShell was used to extract a pfx certificate file.

Attackers may export certificates to .pfx files to use them for authentication, persistence or NTLM extraction.

Check if the pfx creation is legitimate for the user (Testing, IT, etc.).
Follow further actions done by the user (ex. authentication using certificates).

ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Unsecured Credentials: Credentials In Files (T1552.001)
Severity	Low

A user used PowerShell to extract a pfx certificate file.

Attackers may export certificates to .pfx files to use them for authentication, persistence or NTLM extraction.

Check if the pfx creation is legitimate for the user (Testing, IT, etc.).
Follow further actions done by the user (ex. authentication using certificates).