Analytics BIOC Low

Suspicious process accessed certificate files

A suspicious process accessed certificate files.

Module:
Platform Analytics
Data source:
XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Unsecured Credentials (T1552) Steal or Forge Authentication Certificates (T1649)
Attacker's goals:

Attackers may search for local certificate files for authentication, persistence or NTLM extraction.

Investigative actions:

See whether this was a legitimate action. Follow process/user activities.

Test period:
N/A (single event)
Deduplication:
1 Day