PFX File Creation
Detects the creation of PFX (Personal Information Exchange) files. PFX files contain private keys and certificates, making them high-value targets for attackers. Adversaries may create these files to exfiltrate digital certificates for impersonation, establish persistent access via certificate-based authentication, or bypass security controls. Analysts should investigate the process responsible for creating the PFX file, its parent process chain, and any unusual file locations outside of standard certificate stores or development environments.
Sigma
