Techniques › T1552 › T1552.004
T1552.004 Private Keys
credential access — Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
7
Sigma rules tagged attack.t1552.004
1
KEV CVEs mapped here
<p>Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.</p><p>Adversaries may also look in common key directories, such as <code>~/.ssh</code> for SSH keys on * nix-based systems or <code>C:\Users\(username)\.ssh\</code> on Windows. Adversary tools may also search compromised systems for file extensions relating to cryptographic keys and certificates.</p><p>When a device is registered to Entra ID, a device key and a transport key are generated and used to verify the device’s identity. An adversary with access to the device may be able to export the keys in order to impersonate the device.</p><p>On network devices, private keys may be exported via Network Device CLI commands such as
crypto pki export.</p><p>Some private keys require a password or passphrase for operation, so an adversary may also use Input Capture for keylogging or attempt to Brute Force the passphrase off-line. These private keys can be used to authenticate to Remote Services like SSH or for use in decrypting other collected files such as email.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2024-57727 | SimpleHelp SimpleHelp | primary impact | Mapped | 2025-02-13 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0549 Detect Suspicious Access to Private Key Files and Export Attempts Across Platforms v1.0
AN1516 WindowsA process (non-system or user-initiated) accesses private key files in user profile paths or system certificate stores followed by potential network connections or compression activity.Tunable:
FilePathRegexParentProcessNameAN1517 LinuxUser or script-based access to ~/.ssh or other directories containing private keys followed by unusual shell activity or network connections.Tunable:FilePathRegexCommandLineMatchAN1518 macOSAccess to user private key directories (e.g., /Users/*/.ssh) via Terminal, scripting engines, or non-default processes.macos:unifiedloglaunch of bash/zsh/python/osascript targeting key file locations→ DC0032 Process CreationTunable:ProcessNameFileAccessPathAN1519 Network DevicesCLI-based export of private key material (e.g., 'crypto pki export') with anomalous user session or AAA role escalation.Tunable:CLICommandMatchAAAUserContext
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1552.004
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 1f978c6a-4415-47fb-aca5-736a44d7ca3d
Show when private keys are being exported from the device, or when new certificates are installed
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2021-07-20 (modified 2023-03-06) · logsource: product=windows category=process_creation · 213d6a77-3d55-4ce8-ba74-fcfef741974e
Adversaries may search for private key certificate files on compromised systems for insecurely stored credential
Author: Nounou Mbeiri, Nasreddine Bencherchali (Nextron Systems)
· 2024-06-26 · logsource: product=windows category=file_event · 7892ec59-c5bb-496d-8968-e5d210ca3ac4
Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-18 · logsource: product=windows category=process_creation · 9e716b33-63b2-46da-86a4-bd3c3b9b5dfb
Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.
Author: Florian Roth (Nextron Systems)
· 2021-04-23 (modified 2023-05-18) · logsource: product=windows category=ps_script · aa7a3fce-bef5-4311-9cc1-5f04bb8c308c
Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.
Author: Florian Roth (Nextron Systems)
· 2021-04-23 (modified 2023-01-05) · logsource: product=windows category=process_creation · b2815d0d-7481-4bf0-9b6c-a4c48a94b349
Detects a "Get-Process" cmdlet and it's aliases on lsass process, which is in almost all cases a sign of malicious activity
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-05-02 (modified 2025-10-19) · logsource: product=windows category=file_event · dca1b3e8-e043-4ec8-85d7-867f334b5724
Detects the creation of PFX files (Personal Information Exchange format).
PFX files contain private keys and certificates bundled together, making them valuable targets for attackers seeking to:
- Exfiltrate digital certificates for impersonation or signing malicious code
- Establish persistent access through certificate-based authentication
- Bypass security controls that rely on certificate validation
Analysts should investigate PFX file creation events by examining which process created the PFX file and its parent process chain, as well as unusual locations outside standard certificate stores or development environments.
Rules tagged at the parent level (attack.t1552) 13
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
· 2022-06-02 · logsource: product=azure service=auditlogs · 1b45b0d1-773f-4f23-aedc-814b759563b1
Detects when a configuration change is made to an applications AppID URI.
Author: Austin Songer @austinsonger
· 2021-08-16 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 459a2970-bb84-4e6a-a32e-ff0fbd99448d
Identifies when a key vault is modified or deleted.
Author: Austin Songer @austinsonger
· 2021-11-25 (modified 2022-12-18) · logsource: product=gcp service=gcp.audit · 6ad91e31-53df-4826-bd27-0166171c8040
Identifies when an admission controller is executed in GCP Kubernetes.
A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
· 2022-06-02 · logsource: product=azure service=auditlogs · 74298991-9fc4-460e-a92e-511aa60baec1
Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.
Author: Austin Songer @austinsonger
· 2021-08-16 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 80eeab92-0979-4152-942d-96749e11df40
Identifies when a Keyvault Key is modified or deleted in Azure.
Author: kelnage
· 2023-04-03 (modified 2026-04-27) · logsource: product=okta service=okta · 91b76b84-8589-47aa-9605-c837583b82a9
Detects when a user has potentially entered their password into the
username field, which will cause the password to be retained in log files.
Author: Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
· 2023-11-20 (modified 2024-01-24) · logsource: product=windows category=process_creation · 9cd55b6c-430a-4fa9-96f4-7cadf5229e9f
Detect attempts to query the contents of the event log using command line utilities. Attackers use this technique in order to look for sensitive information in the logs such as passwords, usernames, IPs, etc.
Author: Austin Songer @austinsonger
· 2021-11-25 (modified 2022-12-18) · logsource: product=azure service=activitylogs · a61a3c56-4ce2-4351-a079-88ae4cbd2b58
Identifies when an admission controller is executed in Azure Kubernetes.
A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod.
An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Author: Austin Songer @austinsonger
· 2021-08-16 (modified 2022-08-23) · logsource: product=azure service=activitylogs · b831353c-1971-477b-abb6-2828edc3bca1
Identifies when secrets are modified or deleted in Azure.
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
· 2022-09-09 (modified 2025-12-02) · logsource: product=windows category=process_creation · beaa66d6-aa1b-4e3c-80f5-e0145369bfaf
Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs.
This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.
Author: kelnage
· 2024-07-11 · logsource: product=kubernetes service=audit · eed82177-38f5-4299-8a76-098d50d225ab
Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=linux category=process_creation · f0025a69-e1b7-4dda-a53c-db21fa2d4071
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.