T1552.004 — Private Keys

Tactic: Credential Access · Platforms: Linux, macOS, Network Devices, Windows

Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. Common key and certificate file extensions include: .key, .pgp,…

Sub-technique of Unsecured Credentials (T1552).

Sigma detection rules (4)

title: "T1552.004 Unsecured Credentials: Private Keys"
id: f4ebf6cb-aa96-40c9-b7c8-1f45afbb4493
description: 'Detect Creation or Placement of Private Key and Certificate Files Across Platforms. (Retargeted from the original process_creation label to file_event — this is the telemetry source that actually captures this technique''s behavior; see logsource below.) Tune using: FilePathRegex, ParentProcessName.'
references:
  - https://attack.mitre.org/techniques/T1552/004
author: Shahrukh Khan
date: 2026-02-17
license: MIT
tags:
  - attack.credential-access
  - attack.t1552.004

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    TargetFilename|endswith:
      - '.key'
      - '.pgp'
      - '.gpg'
      - '.ppk'
      - '.p12'
      - '.pem'
      - '.pfx'
      - '.cer'
      - '.p7b'
      - '.asc'

  selection_ssh_dir:
    TargetFilename|contains: '\.ssh\'

  condition: selection or selection_ssh_dir

falsepositives:
  - Legitimate certificate/key management activity by developers or IT, including SSH key generation.

level: medium

title: "T1552.004 Unsecured Credentials: Private Keys"
id: 8262f0d8-cf19-4e85-949b-7c212044edb8
description: 'Detect Suspicious Access to Private Key Files and Export Attempts Across Platforms. Now matches the private-key pattern across any positional argument (a1-a4) instead of only a1, since flags and search terms commonly shift the pattern to a later argv position (e.g. find / -name *.pem, grep -r "PRIVATE KEY" /home). Also broadened the extension list. Tune using: FilePathRegex, CommandLineMatch.'
references:
  - https://attack.mitre.org/techniques/T1552/004
author: Shahrukh Khan
date: 2026-01-20
license: MIT
tags:
  - attack.credential-access
  - attack.t1552.004

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/find'
      - '/grep'
  selection_pattern:
    - a1|contains:
        - '.pem'
        - '.key'
        - '.ppk'
        - '.p12'
        - '.pfx'
        - 'PRIVATE KEY'
    - a2|contains:
        - '.pem'
        - '.key'
        - '.ppk'
        - '.p12'
        - '.pfx'
        - 'PRIVATE KEY'
    - a3|contains:
        - '.pem'
        - '.key'
        - '.ppk'
        - '.p12'
        - '.pfx'
        - 'PRIVATE KEY'
    - a4|contains:
        - '.pem'
        - '.key'
        - '.ppk'
        - '.p12'
        - '.pfx'
        - 'PRIVATE KEY'

  condition: selection and selection_pattern

falsepositives:
  - Legitimate certificate-management scripts searching for private key files; scope FilePathRegex to exclude the expected PKI management tooling search patterns.

level: high

title: "T1552.004 Unsecured Credentials: Private Keys"
id: c9768ee9-0bc9-456c-8352-8e2358c7397b
description: 'Detect Suspicious Access to Private Key Files and Export Attempts Across Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ProcessName, FileAccessPath.'
references:
  - https://attack.mitre.org/techniques/T1552/004
author: Shahrukh Khan
date: 2026-02-02
license: MIT
tags:
  - attack.credential-access
  - attack.t1552.004

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/grep'
      - '/find'
      - '/cat'
  selection_target:
    CommandLine|contains:
      - '.ssh/id_rsa'
      - '.ssh/id_ed25519'
      - '/Library/Keychains/'
  condition: selection and selection_target

falsepositives:
  - SSH client configuration tools and backup utilities legitimately reference the same private key paths, so this should be scoped to access from processes that are not ssh, scp, or a recognized backup agent.

level: high

title: "T1552.004 Unsecured Credentials: Private Keys"
id: 9ad02d12-9e68-460c-a148-95cb575b8c64
description: 'Detect Suspicious Access to Private Key Files and Export Attempts Across Platforms. (Data Component: Command Execution; baseline tier: fallback.) Extended the matched file extensions beyond id_rsa/id_ed25519/.ssh to also include .pem, .p12, .pfx, .gpg, .pgp, .cer, and .asc, which the technique description explicitly names as common key/certificate formats that were previously undetected. Tune using: CLICommandMatch, AAAUserContext.'
references:
  - https://attack.mitre.org/techniques/T1552/004
author: Shahrukh Khan
date: 2026-04-04
license: MIT
tags:
  - attack.credential-access
  - attack.t1552.004

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_find:
    type: EXECVE
    a0|endswith:
      - '/find'
      - '/cat'
    a1|contains:
      - 'id_rsa'
      - 'id_ed25519'
      - '.ssh'
      - '.pem'
      - '.p12'
      - '.pfx'
      - '.gpg'
      - '.pgp'
      - '.cer'
      - '.asc'
  selection_copy:
    type: EXECVE
    a0|endswith:
      - '/scp'
      - '/rsync'
    a1|contains:
      - '.ssh'
      - '.pem'
      - '.p12'
      - '.pfx'
      - '.gpg'
      - '.pgp'
      - '.cer'
      - '.asc'

  condition: 1 of selection_*

falsepositives:
  - 'Developers and operations staff legitimately read or copy their own SSH private keys during normal key rotation or workstation setup.'
  - 'Legitimate certificate/key management operations, such as TLS certificate renewal, GPG key export/import, or PKCS12 bundling for application deployment, touching .pem/.p12/.pfx/.gpg/.pgp/.cer/.asc files.'

level: high

Related sub-techniques

• T1552.003 Shell History
• T1552.007 Container API
• T1552.002 Credentials in Registry
• T1552.008 Chat Messages
• T1552.006 Group Policy Preferences
• T1552.005 Cloud Instance Metadata API
• T1552.001 Credentials In Files

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1552.004 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan