T1552.004 Private Keys
Subtécnica de T1552 Unsecured Credentials
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc. Adversaries…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Cisco Crypto Commandshightest · cisco
- DPAPI Backup Keys And Certificate Export Activity IOChightest · windows
- PowerShell Get-Process LSASShightest · windows
- Certificate Exported Via PowerShellmediumtest · windows
- Certificate Exported Via PowerShell - ScriptBlockmediumtest · windows
- Private Keys Reconnaissance Via CommandLine Toolsmediumtest · windows
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.