Cisco Crypto Commands — Detection Rule

Show when private keys are being exported from the device, or when new certificates are installed

Read the full analysis on IntelFusions