admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update windows_steal_authentication_certificates_cryptoapi.yml

Browse Source
This commit is contained in:
Michael Haag
2023-02-21 09:07:23 -07:00
committed by GitHub
parent f2334bc080
commit f73d760571
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml
+2 -2
View File
@@ -6,7 +6,7 @@ author: Michael Haag, Splunk
type: Anomaly
datamodel: []
description: The following analytic utilizes a Windows Event Log - CAPI2 - or CryptoAPI 2, to identify suspicious certificate extraction. Typically, this event log is meant for diagnosing PKI issues, however is a great source to identify certificate exports.
Note that this event log is noisy as it captures common PKI requests from many different processes. EventID 70 is generated anytime a certificate is exported. The description for EventID 70 is "Acquire Certifcate Private Key".
Note that this event log is noisy as it captures common PKI requests from many different processes. EventID 70 is generated anytime a certificate is exported. The description for EventID 70 is "Acquire Certificate Private Key".
STRT tested this analytic using Mimikatz binary and the implementation of Mimikatz in Cobalt Strike.
search: '`capi2_operational` EventCode=70
| xmlkv UserData_Xml
@@ -51,4 +51,4 @@ tags:
- Computer
- UserData_Xml
risk_score: 24
security_domain: endpoint
security_domain: endpoint