value:  Mimikatz's CRYPTO::Extract module can extract keys by interacting with Windows cryptographic application programming interface (API) functions. ;; Operation Wocao has used Mimikatz to dump certificates and private keys from the Windows certificate store. ;; Rocke has used SSH private keys on the infected machine to spread its coinminer throughout a network. ;; UNC2452 obtained the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.
name: Unsecured Credentials: Private Keys