AN1516
Analytic 1516
Windows
A process (non-system or user-initiated) accesses private key files in user profile paths or system certificate stores followed by potential network connections or compression activity.
WinEventLog:Sysmon
EventCode=11
WinEventLog:Security
EventCode=5145
WinEventLog:Sysmon
EventCode=1
[FilePathRegex]
Regex for matching key file extensions (.pem, .pfx, .ppk, etc.) or known certificate directories like C:\Users\*\.ssh\
[ParentProcessName]
Set of known benign certificate management tools to exclude (e.g., certutil.exe, ssh.exe)
AN1517
Analytic 1517
Linux
User or script-based access to ~/.ssh or other directories containing private keys followed by unusual shell activity or network connections.
auditd:SYSCALL
openat
auditd:EXECVE
execve
[FilePathRegex]
Directory/file path regex for ~/.ssh, *.pem, *.key, *.p12
[CommandLineMatch]
Script or user agent seen accessing keys (e.g., cat ~/.ssh/id_rsa, tar ~/.gnupg)
AN1518
Analytic 1518
macOS
Access to user private key directories (e.g., /Users/*/.ssh) via Terminal, scripting engines, or non-default processes.
macos:unifiedlog
open/read access to private key files (id_rsa, *.pem, *.p12)
macos:unifiedlog
launch of bash/zsh/python/osascript targeting key file locations
[ProcessName]
Processes reading key files (osascript, python, bash, etc.)
[FileAccessPath]
Private key and certificate paths like /Users/*/.ssh, /Library/Keychains/
AN1519
Analytic 1519
Network Devices
CLI-based export of private key material (e.g., 'crypto pki export') with anomalous user session or AAA role escalation.
networkdevice:syslog
Detected CLI command to export key material
[CLICommandMatch]
Regex for export commands (e.g., crypto pki export, export ssh-key)
[AAAUserContext]
Source username or role performing export — may tune for known admins