Detect Steal or Forge Authentication Certificates in Microsoft Sentinel

let CertTheftCLIKeywords = dynamic(["-exportpfx", "exportpfx", "crypto::certificates", "crypto::capi", "crypto::keys", "/export", "-pkcs12", "adcs", "certsrv", "certstore", "-repairstore", "-importpfx"]);
let KnownCertTheftTools = dynamic(["certify.exe", "certipy.exe", "sharpdpapi.exe", "sharpweb.exe", "certstealer.exe", "ghostpack"]);
let SensitiveExtensions = dynamic([".pfx", ".p12", ".pem", ".key"]);
// Detection 1: Process-based — certutil/certreq abuse and known tools
let ProcessDetections = DeviceProcessEvents
| where TimeGenerated > ago(1d)
| where (
    (FileName =~ "certutil.exe" and ProcessCommandLine has_any (CertTheftCLIKeywords))
    or (FileName =~ "certreq.exe" and (ProcessCommandLine has "-submit" or ProcessCommandLine has "-retrieve"))
    or FileName has_any (KnownCertTheftTools)
    or ProcessCommandLine has_any ("crypto::certificates", "crypto::capi /patch", "crypto::keys /export", "sekurlsa::certificates")
  )
| extend DetectionSource = "ProcessEvent"
| extend SuspiciousIndicator = case(
    ProcessCommandLine has "exportpfx", "CertUtil Certificate Export",
    ProcessCommandLine has "crypto::certificates", "Mimikatz Cert Module",
    ProcessCommandLine has "crypto::capi", "Mimikatz CryptoAPI Patch",
    ProcessCommandLine has "crypto::keys", "Mimikatz Key Export",
    ProcessCommandLine has "sekurlsa::certificates", "Mimikatz LSA Cert Dump",
    FileName has_any (KnownCertTheftTools), "Known Cert Theft Tool",
    "Suspicious Certificate CLI Activity"
  )
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName,
    FileName, ProcessCommandLine, SuspiciousIndicator, FolderPath, DetectionSource;
// Detection 2: File-based — suspicious PFX/P12 written to non-standard locations
let FileDetections = DeviceFileEvents
| where TimeGenerated > ago(1d)
| where ActionType in ("FileCreated", "FileModified")
| where FileName has_any (SensitiveExtensions)
| where not(FolderPath has_any (
    "C:\\Windows\\System32\\CertSrv",
    "C:\\ProgramData\\Microsoft\\Crypto",
    "C:\\Users\\All Users\\Microsoft\\Crypto",
    "C:\\Windows\\ServiceProfiles"
  ))
| where InitiatingProcessFileName !in~ ("svchost.exe", "lsass.exe", "MicrosoftEdgeUpdate.exe")
| extend DetectionSource = "FileEvent"
| extend SuspiciousIndicator = "Certificate File Written to Non-Standard Location"
| project TimeGenerated, DeviceName, AccountName = InitiatingProcessAccountName,
    InitiatingProcessFileName, FileName, FolderPath, SuspiciousIndicator, DetectionSource;
// Detection 3: AD CS enrollment anomalies from Security event log
let ADCSDetections = SecurityEvent
| where TimeGenerated > ago(1d)
| where EventID in (4886, 4887, 4899, 4900)
| extend CertRequestDetails = parse_xml(EventData)
| where EventID in (4886, 4887) and SubjectUserName !endswith "$"
| extend DetectionSource = "SecurityEvent"
| extend SuspiciousIndicator = case(
    EventID == 4886, "AD CS Certificate Request Received (User Account)",
    EventID == 4887, "AD CS Certificate Issued to User Account",
    EventID == 4899, "AD CS Certificate Template Modified",
    EventID == 4900, "AD CS Certificate Template Security Updated",
    "AD CS Event"
  )
| project TimeGenerated, DeviceName = Computer, AccountName = SubjectUserName,
    InitiatingProcessFileName = "", FileName = "", FolderPath = "",
    SuspiciousIndicator, DetectionSource;
union ProcessDetections, FileDetections, ADCSDetections
| order by TimeGenerated desc