SigmaHQ/rules/windows/file_event/sysmon_susp_pfx_file_creation.yml

title: Suspicious PFX File Creation
id: dca1b3e8-e043-4ec8-85d7-867f334b5724
description: A General detection for processes creating PFX files. This could be an inidicator of an adversary exporting a local certificate to a pfx file.
status: experimental
date: 2020/05/02
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
tags:
    - attack.credential_access
    - attack.t1552.004
references:
    - https://github.com/OTRF/detection-hackathon-apt29/issues/14
    - https://threathunterplaybook.com/evals/apt29/detections/6.B.1_6392C9F1-D975-4F75-8A70-433DEDD7F622.html
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|endswith: '.pfx'
    condition: selection
falsepositives:
    - unknown
level: medium
16 rules from DH APT29 day 1 - contributing soon 2020-10-12 22:13:13 +00:00			`title: Suspicious PFX File Creation`
			`id: dca1b3e8-e043-4ec8-85d7-867f334b5724`
			`description: A General detection for processes creating PFX files. This could be an inidicator of an adversary exporting a local certificate to a pfx file.`
			`status: experimental`
			`date: 2020/05/02`
			`author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)`
			`tags:`
			`- attack.credential_access`
			`- attack.t1552.004`
			`references:`
			`- https://github.com/OTRF/detection-hackathon-apt29/issues/14`
			`- https://threathunterplaybook.com/evals/apt29/detections/6.B.1_6392C9F1-D975-4F75-8A70-433DEDD7F622.html`
			`logsource:`
			`product: windows`
- Modified rules to use categories instead of hardcoded event IDs - Added file_delete category (Sysmon Event ID 23) to the generic translation file 2021-04-14 23:40:31 +00:00			`category: file_event`
16 rules from DH APT29 day 1 - contributing soon 2020-10-12 22:13:13 +00:00			`detection:`
			`selection:`
			`TargetFilename\|endswith: '.pfx'`
			`condition: selection`
			`falsepositives:`
			`- unknown`
			`level: medium`