A process (non-system or user-initiated) accesses private key files in user profile paths or system certificate stores followed by potential network connections or compression activity.
| Data Component | Name | Channel |
|---|---|---|
| File Creation (DC0039) | WinEventLog:Sysmon | EventCode=11 |
| Network Share Access (DC0102) | WinEventLog:Security | EventCode=5145 |
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 |
| Field | Description |
|---|---|
| FilePathRegex | Regex for matching key file extensions (.pem, .pfx, .ppk, etc.) or known certificate directories like C:\Users\*\.ssh\ |
| ParentProcessName | Set of known benign certificate management tools to exclude (e.g., certutil.exe, ssh.exe) |
User or script-based access to ~/.ssh or other directories containing private keys followed by unusual shell activity or network connections.
| Data Component | Name | Channel |
|---|---|---|
| File Access (DC0055) | auditd:SYSCALL | openat |
| Process Creation (DC0032) | auditd:EXECVE | execve |
| Field | Description |
|---|---|
| FilePathRegex | Directory/file path regex for ~/.ssh, *.pem, *.key, *.p12 |
| CommandLineMatch | Script or user agent seen accessing keys (e.g., cat ~/.ssh/id_rsa, tar ~/.gnupg) |
Access to user private key directories (e.g., /Users/*/.ssh) via Terminal, scripting engines, or non-default processes.
| Data Component | Name | Channel |
|---|---|---|
| File Access (DC0055) | macos:unifiedlog | open/read access to private key files (id_rsa, *.pem, *.p12) |
| Process Creation (DC0032) | macos:unifiedlog | launch of bash/zsh/python/osascript targeting key file locations |
| Field | Description |
|---|---|
| ProcessName | Processes reading key files (osascript, python, bash, etc.) |
| FileAccessPath | Private key and certificate paths like /Users/*/.ssh, /Library/Keychains/ |
CLI-based export of private key material (e.g., 'crypto pki export') with anomalous user session or AAA role escalation.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | networkdevice:syslog | Detected CLI command to export key material |
| Field | Description |
|---|---|
| CLICommandMatch | Regex for export commands (e.g., crypto pki export, export ssh-key) |
| AAAUserContext | Source username or role performing export — may tune for known admins |