T1552.004sub-technique of T1552 Unsecured Credentials
Private Keys
Linux · macOS · Network Devices · Windowsnothing on this site yetT1552.004 on attack.mitre.org
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. Common key and certificate file extensions include:.key,.pgp,.gpg,.ppk.,.p12,.pem,.pfx,.cer,.p7b,.asc.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Detect Suspicious Access to Private Key Files and Export Attempts Across Platforms
- A process (non-system or user-initiated) accesses private key files in user profile paths or system certificate stores followed by potential network connections or compression activity.
- User or script-based access to ~/.ssh or other directories containing private keys followed by unusual shell activity or network connections.
- Access to user private key directories (e.g., /Users/*/.ssh) via Terminal, scripting engines, or non-default processes.
- CLI-based export of private key material (e.g., 'crypto pki export') with anomalous user session or AAA role escalation.
what reduces it
- M1027 Password Policies. Use strong passphrases for private keys to make cracking difficult.
- M1022 Restrict File and Directory Permissions. Ensure permissions are properly set on folders containing sensitive private keys to prevent unintended access. Additionally, on Cisco devices, set the `nonexportable` flag during RSA key pair generation.
- M1047 Audit. Ensure only authorized keys are allowed access to critical resources and audit access lists regularly.
- M1041 Encrypt Sensitive Information. When possible, store keys on separate cryptographic hardware instead of on the local system. For example, on Windows systems use a TPM to secure keys and other sensitive credential material.