title: Suspicious PFX File Creation
id: dca1b3e8-e043-4ec8-85d7-867f334b5724
status: test
description: A general detection for processes creating PFX files. This could be an indicator of an adversary exporting a local certificate to a PFX file.
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
references:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/14
  - https://threathunterplaybook.com/evals/apt29/detections/6.B.1_6392C9F1-D975-4F75-8A70-433DEDD7F622.html
date: 2020/05/02
modified: 2021/11/27
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith: '.pfx'
  condition: selection
falsepositives:
  - System administrators managing certififcates.
level: medium
tags:
  - attack.credential_access
  - attack.t1552.004
