name: Certutil exe certificate extraction
id: 337a46be-600f-11eb-ae93-0242ac130002
version: 1
date: '2021-01-26'
author: Rod Soto, Splunk
type: batch
datamodel:
- Endpoint
description: This search looks for arguments to certutil.exe indicating the manipulation
  or extraction of Certificate. This certificate can then be used to sign new authentication
  tokens specially inside Federated environments such as Windows ADFS.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
  as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe
  Processes.process = "* -exportPFX *" by Processes.parent_process Processes.process_name
  Processes.process Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
  |`security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter`'
how_to_implement: ''
known_false_positives: Unless there are specific use cases, manipulating or exporting
  certificates using certutil is uncommon. Extraction of certificate has been observed
  during attacks such as Golden SAML and other campaigns targeting Federated services.
references: []
tags:
  analytic_story:
  - Windows Persistence Techniques
  - Cloud Federated Credential Abuse
  asset_type: Endpoint
  automated_detection_testing: passed
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log
  kill_chain_phases:
  - Installation
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.process
  - Processes.process_name
  - Processes.parent_process
  - Processes.user
  security_domain: endpoint
