Private Key Files

Description

Private Key Files. This query identifies file operation with files having. One of the extensions commonly used to save a private. Key. The risk is that if an attacker were to obtain. The file, they could brute force any password on it. And potentially obtain a powerful certificate. To do. This, they would only need to obtain read access to. The file. The risk associated with these files is heavily. Determined by the value of the certificate. For example,. Loss of a self-signed certificate created by Adobe Acrobat. Is significantly less impactful than loss of a website. SSL certificate. Recommendation: Know where these files are, and if possible. Back them up and remove them. You might also consider. Creating an informational alert.

Query · kql

DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName endswith '.pfx' or FileName endswith '.pfn' or FileName endswith '.p12'
Raw source Private Key Files · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 2ca01fd3-afb5-4050-8a1d-6b821bdab080
name: Private Key Files
description: |
  Private Key Files.
  This query identifies file operation with files having.
  One of the extensions commonly used to save a private.
  Key.  The risk is that if an attacker were to obtain.
  The file, they could brute force any password on it.
  And potentially obtain a powerful certificate.  To do.
  This, they would only need to obtain read access to.
  The file.
  The risk associated with these files is heavily.
  Determined by the value of the certificate.  For example,.
  Loss of a self-signed certificate created by Adobe Acrobat.
  Is significantly less impactful than loss of a website.
  SSL certificate.
  Recommendation: Know where these files are, and if possible.
  Back them up and remove them.  You might also consider.
  Creating an informational alert.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
query: |
  DeviceFileEvents
  | where Timestamp > ago(7d)
  | where FileName endswith '.pfx' or FileName endswith '.pfn' or FileName endswith '.p12'

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.