Cross-source coverage
T1552.004 / ATT&CK
Unsecured Credentials: Private Keys
34 rules across 8 sources.
From MITRE ATT&CK 19.2
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. Common key and certificate file extensions include:.key,.pgp,.gpg,.ppk.,.p12,.pem,.pfx,.cer,.p7b,.asc.
Adversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows. Adversary tools may also search compromised systems for file extensions relating to cryptographic keys and certificates.
When a device is registered to Entra ID, a device key and a transport key are generated and used to verify the device’s identity. An adversary with access to the device may be able to export the keys in order to impersonate the device.
On network devices, private keys may be exported via Network Device CLI commands such as crypto pki export.
Some private keys require a password or passphrase for operation, so an adversary may also use Input Capture for keylogging or attempt to Brute Force the passphrase off-line. These private keys can be used to authenticate to Remote Services like SSH or for use in decrypting other collected files such as email.
- Tactics
- Credential Access
- Platforms
- Linux · macOS · Network Devices · Windows
- Telemetry
-
WinEventLog:SysmonWinEventLog:Securityauditd:SYSCALLauditd:EXECVEmacos:unifiedlognetworkdevice:syslog
How MITRE says to detect it DET0549
Detect Suspicious Access to Private Key Files and Export Attempts Across Platforms
Windows Analytic 1516
A process (non-system or user-initiated) accesses private key files in user profile paths or system certificate stores followed by potential network connections or compression activity.
WinEventLog:SysmonEventCode=11WinEventLog:SecurityEventCode=5145WinEventLog:SysmonEventCode=1
Linux Analytic 1517
User or script-based access to ~/.ssh or other directories containing private keys followed by unusual shell activity or network connections.
auditd:SYSCALLopenatauditd:EXECVEexecve
macOS Analytic 1518
Access to user private key directories (e.g., /Users/*/.ssh) via Terminal, scripting engines, or non-default processes.
macos:unifiedlogopen/read access to private key files (id_rsa, *.pem, *.p12)macos:unifiedloglaunch of bash/zsh/python/osascript targeting key file locations
Network Devices Analytic 1519
CLI-based export of private key material (e.g., 'crypto pki export') with anomalous user session or AAA role escalation.
networkdevice:syslogDetected CLI command to export key material
elastic/detection-rules
10 rules| Detection | Severity | Format |
|---|---|---|
| AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization | High | Elastic TOML |
| Creation or Modification of Domain Backup DPAPI private key | High | Elastic TOML |
| Google Workspace Drive Encryption Key(s) Accessed from Anonymous User | High | Elastic TOML |
| Private Key Searching Activity | High | Elastic TOML |
| Protected Storage Service Access via SMB | High | Elastic TOML |
| Access to a Sensitive LDAP Attribute | Medium | Elastic TOML |
| Sensitive Keys Or Passwords Search Detected via Defend for Containers | Medium | Elastic TOML |
| Suspicious CertUtil Commands | Medium | Elastic TOML |
| Kubelet Certificate File Access Detected via Defend for Containers | Low | Elastic TOML |
| Potential Privilege Escalation via Linux DAC permissions | Low | Elastic TOML |
SigmaHQ/sigma
7 rules| Detection | Severity | Format |
|---|---|---|
| Cisco Crypto Commands | High | Sigma |
| DPAPI Backup Keys And Certificate Export Activity IOC | High | Sigma |
| PowerShell Get-Process LSASS | High | Sigma |
| Certificate Exported Via PowerShell | Medium | Sigma |
| Certificate Exported Via PowerShell - ScriptBlock | Medium | Sigma |
| Private Keys Reconnaissance Via CommandLine Tools | Medium | Sigma |
| PFX File Creation | Low | Sigma |
splunk/security_content
6 rules| Detection | Severity | Format |
|---|---|---|
| Linux Auditd Find Ssh Private Keys | Undefined | SPL |
| Linux Auditd Private Keys and Certificate Enumeration | Undefined | SPL |
| Windows Export Certificate | Undefined | SPL |
| Windows PowerShell Export Certificate | Undefined | SPL |
| Windows PowerShell Export PfxCertificate | Undefined | SPL |
| Windows Private Keys Discovery | Undefined | SPL |
socfortress/Wazuh-Rules
5 rules| Detection | Severity | Format |
|---|---|---|
| Detected rsync used to exfiltrate GnuPG directory to /tmp/GnuPG (T1552.004) | High | Wazuh XML |
| Detected rsync used to stage SSH private keys to /tmp/art-staging (T1552.004) | High | Wazuh XML |
| Possible credential theft attempt: copying private SSH keys using 'find' and 'cp' | High | Wazuh XML |
| Possible credential theft: rsync used to copy private SSH keys | High | Wazuh XML |
| Suspicious copy of SSH private key file detected (cp id_rsa) | Medium | Wazuh XML |
chronicle/detection-rules
3 rules| Detection | Severity | Format |
|---|---|---|
| adfs_dkm_key_access | High | YARA-L |
| google_workspace_encryption_key_files_accessed_by_anonymous_user | Medium | YARA-L |
| gcp_service_account_key_used_from_multiple_countries | Low | YARA-L |
Wazuh Core Ruleset
1 rule| Detection | Severity | Format |
|---|---|---|
| Powershell process created PFX file . Possible private key or certificate exportation · win.eventdata.image = (?i)powershell\.exe | Medium | Wazuh XML |
elastic/protections-artifacts
1 rule| Detection | Severity | Format |
|---|---|---|
| SSH Keys Accessed by Osascript | Undefined | Elastic TOML |
panther-labs/panther-analysis
1 rule| Detection | Severity | Format |
|---|---|---|
| Kubernetes Ingress Created Without TLS | Medium | Panther Python |