| splunk |
Windows PowerShell Export PfxCertificate |
production |
2026-10-09 |
| splunk |
Windows Steal Authentication Certificates CryptoAPI |
production |
2026-10-09 |
| splunk |
Windows Export Certificate |
production |
2026-10-09 |
| splunk |
Windows Mimikatz Crypto Export File Extensions |
production |
2026-10-09 |
| splunk |
Windows PowerShell Export Certificate |
production |
2026-10-09 |
| splunk |
Windows Steal Authentication Certificates Export PfxCertificate |
production |
2026-10-09 |
| splunk |
Windows Steal Authentication Certificates Export Certificate |
production |
2026-10-09 |
| elastic |
Access to a Sensitive LDAP Attribute |
production |
2026-10-06 |
| splunk |
Steal or Forge Authentication Certificates Behavior Identified |
production |
2026-10-02 |
| elastic |
Potential CertiGhost AD CS Machine Identity Mismatch (CVE-2026-54121) |
production |
2026-09-18 |
| elastic |
Azure AKS Certificate Signing Request Created or Approved |
production |
2026-09-18 |
| elastic |
Potential Invoke-Mimikatz PowerShell Script |
production |
2026-09-18 |
| sigma |
ADCS - Certighost Ghost Machine Account Creation |
experimental |
2026-07-30 |
| sigma |
ADCS - Certighost Certificate Issued via CDC Chase (CVE-2026-54121) |
experimental |
2026-07-27 |
| sigma |
ADCS - Certighost CDC Chase Certificate Request (CVE-2026-54121) |
experimental |
2026-07-27 |
| splunk |
Windows Steal Authentication Certificates Certificate Request |
production |
2026-05-13 |
| splunk |
Certutil exe certificate extraction |
production |
2026-05-13 |
| splunk |
Detect Certify Command Line Arguments |
production |
2026-05-13 |
| splunk |
Detect Certify With PowerShell Script Block Logging |
production |
2026-05-13 |
| splunk |
Detect Certipy File Modifications |
production |
2026-05-13 |
| splunk |
Windows Steal Authentication Certificates - ESC1 Abuse |
production |
2026-05-13 |
| splunk |
Windows Steal Authentication Certificates - ESC1 Authentication |
production |
2026-05-13 |
| splunk |
Windows Steal Authentication Certificates Certificate Issued |
production |
2026-05-13 |
| splunk |
Windows Steal Authentication Certificates CertUtil Backup |
production |
2026-05-13 |
| splunk |
Windows Steal Authentication Certificates CS Backup |
production |
2026-05-13 |
| sigma |
HackTool - Certipy Execution |
test |
2024-10-08 |
| sigma |
Certificate Private Key Acquired |
test |
2023-05-13 |
| sigma |
Certificate Exported From Local Certificate Store |
test |
2023-05-13 |
| sigma |
HackTool - Certify Execution |
test |
2023-04-25 |