Private Keys Reconnaissance Via CommandLine Tools — Detection Rule

Adversaries may search for private key certificate files on compromised systems for insecurely stored credential

Read the full analysis on IntelFusions