Harvest Private Keys

Adversaries may search compromised systems for insecurely stored private keys or certificates that can expose key material. A private key may enable authentication, decryption, or digital signing depending on its purpose, permissions, and protection. A certificate showing an associated private key does not establish that the key is exportable or accessible to the current user. The procedure documented in this entry is limited to read-only inventory of the Windows CurrentUser\My and LocalMachine\My certificate stores; it does not search private-key files or cover the other ATT&CK platforms.