Certutil exe certificate extraction

Hypothesis and description

This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS.

Platforms: Windows
Domain: Analytic
Subtypes: Process
Submitted: 2021-05-11
Contributors: Splunk Threat Research <research@splunk.com>

ATT&CK coverage

Technique	Tactics	Coverage
T1606 Forge Web CredentialsT1606.002	Credential Access	Moderate

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1606Forge Web Credentials
.002 SAML Tokens

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodePseudocode - CertUtil certificate extractionData model: CAR native

Pseudocode implementation of the Splunk search below

processes = search Process:Create
certutil_downloads = filter processes where (
  exe =”C:\Windows\System32\certutil.exe” AND command_line = * -exportPFX * )
output certutil_downloads

SplunkSplunk codeData model: Endpoint

Splunk implementation

| tstats count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *" by Processes.parent_process Processes.process_name Processes.process Processes.user

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

View CAR-2021-05-008 on car.mitre.org

Technique

Tactics

Coverage

T1606 Forge Web CredentialsT1606.002

Credential Access

Moderate

Pseudocode and implementations

PseudocodePseudocode - CertUtil certificate extractionData model: CAR native

Pseudocode implementation of the Splunk search below

processes = search Process:Create
certutil_downloads = filter processes where (
  exe =”C:\Windows\System32\certutil.exe” AND command_line = * -exportPFX * )
output certutil_downloads

SplunkSplunk codeData model: Endpoint

Splunk implementation

| tstats count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *" by Processes.parent_process Processes.process_name Processes.process Processes.user