T1552.004Credential Access
Private Keys
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. Common key and certificate file extensions include:.key,.pgp,.gpg,.ppk.,.p12,.pem,.pfx,.cer,.p7b,.asc. Adversaries may also look in common key directories, such as…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
7 Sigma rules tagged T1552.004Private KeysT1552.0047 general rules
- Cisco Crypto Commandshightest
- DPAPI Backup Keys And Certificate Export Activity IOChightest
- PowerShell Get-Process LSASShightest
- Certificate Exported Via PowerShellmediumtest
- Certificate Exported Via PowerShell - ScriptBlockmediumtest
- Private Keys Reconnaissance Via CommandLine Toolsmediumtest
- PFX File Creationlowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Private Keys
1 CVE, by priority. Each link shows its badge.- CVE-2024-57727SimpleHelp Path Traversal VulnerabilitySimpleHelp · SimpleHelpKEVRansomwarePublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+3 moreMITRE CTID mapping of the KEV entry · primary impact96.8%Top 0.11%78.2priority