Private key export from a Linux certificate or key store

Siemphony@siemphonylowT1649unverified

Matches the command-execution half of AN0672 — a process invoking OpenSSL, the NSS tools or keytool in a mode that moves private key material out of a key store: PKCS#12 and PKCS#8 handling by openssl, pk12util or certutil pointed at an NSS database under ~/.pki, and keytool's -importkeystore / -exportcert. Each selection pairs the binary with the subcommand rather than alerting on the binary alone, because openssl and certutil are ordinary administrative tools whose other subcommands say nothing about key theft. The other half of AN0672 — auditd open/read on /etc/ssl/, /etc/pki/ and ~/.pki/nssdb — is deliberately not folded in here: it lives on the raw linux:auditd log source with a filesystem watch and its own field vocabulary (type, name, exe, key), which this process_creation rule cannot express, so it needs a separate rule and a loaded `-w` watch. Windows (AN0671, Security 4768 and 4657) and macOS (AN0673, Keychain) are not covered by this rule. auditd records no execve without an audit rule such as `-a always,exit -F arch=b64 -S execve`; until one is loaded this rule returns zero rows because nothing is being collected, not because nothing happened. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0240, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "/openssl" and (ProcessCommandLine contains "pkcs12" or ProcessCommandLine contains "pkcs8")) or ((FolderPath endswith "/pk12util" or FolderPath endswith "/certutil") and (ProcessCommandLine contains "/nssdb" or ProcessCommandLine contains "/.pki")) or (FolderPath endswith "/keytool" and (ProcessCommandLine contains "-importkeystore" or ProcessCommandLine contains "-exportcert")))

Splunk · SPL

Run this as a search.

index=* ((Image="*/openssl" AND (CommandLine="*pkcs12*" OR CommandLine="*pkcs8*")) OR ((Image="*/pk12util" OR Image="*/certutil") AND (CommandLine="*/nssdb*" OR CommandLine="*/.pki*")) OR (Image="*/keytool" AND (CommandLine="*-importkeystore*" OR CommandLine="*-exportcert*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*/openssl" AND (TO_LOWER(process.command_line) LIKE "*pkcs12*" OR TO_LOWER(process.command_line) LIKE "*pkcs8*")) OR ((TO_LOWER(process.executable) LIKE "*/pk12util" OR TO_LOWER(process.executable) LIKE "*/certutil") AND (TO_LOWER(process.command_line) LIKE "*/nssdb*" OR TO_LOWER(process.command_line) LIKE "*/.pki*")) OR (TO_LOWER(process.executable) LIKE "*/keytool" AND (TO_LOWER(process.command_line) LIKE "*-importkeystore*" OR TO_LOWER(process.command_line) LIKE "*-exportcert*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 3 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)/openssl$</field>    <field name="CommandLine" type="pcre2">(?i)(pkcs12|pkcs8)</field>    <description>Private key export from a Linux certificate or key store (1/3)</description>    <mitre>      <id>T1649</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/pk12util$|/certutil$)</field>    <field name="CommandLine" type="pcre2">(?i)(/nssdb|/\.pki)</field>    <description>Private key export from a Linux certificate or key store (2/3)</description>    <mitre>      <id>T1649</id>    </mitre>  </rule>   <rule id="100002" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)/keytool$</field>    <field name="CommandLine" type="pcre2">(?i)(-importkeystore|-exportcert)</field>    <description>Private key export from a Linux certificate or key store (3/3)</description>    <mitre>      <id>T1649</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: low
Category: kerberos_ticket_abuse
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 9ea92a22-9f2d-4b8a-bf23-89a5d8cc9d42

ATT&CKT1649

T1649Steal or Forge Authentication Certificates

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonkerberos ticket abuse

kerberos ticket abuseAI draft — unreviewed

01 · What this rule detects

A process on Linux invoking OpenSSL, the NSS tools, or keytool in a mode that moves private key material out of a key store. This is the command-execution half of AN0672: not certificate use, but certificate and key export — the step that turns a key sitting in a store into a file an adversary can carry away. Windows (AN0671, Security 4768 and registry) and macOS (AN0673, Keychain) are not covered by this rule.

02 · Telemetry you need

process_creation/linux, taken from AN0672's second log source. The prerequisite is the same one that catches every Linux execution rule: auditd records no execve at all without a rule such as -a always,exit -F arch=b64 -S execve loaded. Until one is, this rule returns zero rows because nothing is being collected — not because nothing happened. Also confirm your normaliser populates Image with the resolved binary path; on a raw auditd:SYSCALL feed the exe= field holds the interpreter, which is what makes wrapper scripts vanish.

03 · How the logic works

Three selections, OR-ed with 1 of selection_*, and every one of them pairs a binary with a subcommand rather than alerting on the binary alone. That pairing is the whole design: openssl and certutil are ordinary administrative tools, and their other subcommands say nothing about key theft. selection_openssl requires Image|endswith: '/openssl' and CommandLine|contains one of pkcs12 or pkcs8 — the two container formats OpenSSL uses to bundle or unwrap a private key. selection_nss requires /pk12util or /certutil together with /nssdb or /.pki in the command line, scoping the match to an NSS database rather than to any use of those tools. Note this is the NSS certutil, not the Windows binary of the same name. selection_keytool requires /keytool with -importkeystore or -exportcert, the two Java keystore operations that move material across store boundaries. The other half of AN0672 — auditd open/read on /etc/ssl/, /etc/pki/, and ~/.pki/nssdb — is deliberately not folded in. It lives on the raw linux:auditd source with its own field vocabulary (type, name, exe, key) and needs a loaded -w watch, so it is a separate rule, not a fourth selection here.

04 · Common false positives

Chiefly from automation, and that is what holds the level at low. Certificate lifecycle tooling on any TLS-terminating host runs openssl pkcs12 -export to rebundle a renewed certificate and key: cert-manager and Certbot deploy hooks, Puppet and Ansible PKI roles, internal CA renewal crons. On a fleet with automated renewal this recurs on a schedule and outweighs every other match combined. Java installs and container entrypoints call keytool -importkeystore to convert a PKCS#12 bundle into a JKS keystore at deploy or first start, once per deployment per host. On desktop Linux, certutil -d sql:$HOME/.pki/nssdb is how the corporate root CA gets into the Chrome and Firefox trust stores.

05 · Detection maturity

tier_1: Lowest tier, and it stays there until the rule is run against real data. Nothing here has touched a log line: the volume claims above are reasoned from how the tools are normally used, not measured on your fleet.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE names PathExclusions — exempt trusted automated services that regularly touch PKI stores — and that is exactly the right first move: exclude the service accounts and parent processes behind your renewal automation, and the residue becomes interactive, human, and worth a look. MITRE's UserContext knob separates root and system accounts from user-level access to key material; apply it after PathExclusions, not instead of it. The subcommand strings in all three selections are authored by this pipeline, not supplied by MITRE, and are the first thing to widen if your estate uses other export paths.

Declared by the author

Certificate lifecycle automation on any host that terminates TLS — a cert-manager or Certbot deploy hook, a Puppet or Ansible PKI role, or an internal CA renewal cron that runs openssl pkcs12 -export to rebundle a renewed certificate and key for an application. On a fleet with automated renewal this recurs on a schedule and outweighs every other match, which is why the level is set low until MITRE's PathExclusions knob is populated with those service accounts.
Java application installs and container entrypoints that call keytool -importkeystore to convert a PKCS#12 bundle into a JKS keystore at deploy or first start, firing once per deployment per host.
Desktop Linux fleets where an enterprise policy script or an administrator runs certutil -d sql:$HOME/.pki/nssdb to install or refresh the corporate root CA in the Chrome and Firefox trust stores.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1649, evaluated against their process_creation events.

Share this rule

/u/siemphony/9ea92a22-9f2d-4b8a-bf23-89a5d8cc9d42

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Private key export from a Linux certificate or key store

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it