Overview
The Certificates command enumerates personal certificates stored in both user and machine certificate stores. These certificates may be used for authentication, encryption, code signing, or other cryptographic operations, and can reveal valuable information about the system’s security posture and trust relationships.Syntax
This command does not support remote execution.
Output
The command returns certificate information including:- Subject name
- Issuer
- Serial number
- Validity period (NotBefore/NotAfter)
- Thumbprint
- Key usage
- Enhanced key usage
- Certificate template
- Store location (User/Machine)
Use Cases
- Red Team
- Blue Team
- Find certificates for authentication
- Identify code signing certificates
- Discover client authentication certificates
- Locate certificates for credential theft
- Identify trust relationships
- Find expired or weak certificates
Example Output
Remote Execution
Detection Considerations
This command has minimal detection surface:
- API Calls: Uses CryptoAPI functions to enumerate certificate stores
- Low Privilege: No special privileges required for user stores
- EDR Telemetry: May be logged as process behavior
- No Network Activity: Operates entirely locally
Defensive Recommendations
- Monitor execution of reconnaissance tools
- Correlate with other enumeration activities
- Track access to certificate private keys
- Enable process creation logging
Related Commands
- CertificateThumbprints - Thumbprints for all certificates
- DPAPI MasterKeys - DPAPI master key enumeration
- CredGuard - Credential Guard configuration