Detection rules › By eventMicrosoft-Windows-CertificateServicesClient-Lifecycle-System event 10072 detection rules reference this event. View event page.Sigma (1)Certificate Exported From Local Certificate Store severity medium T1649 Splunk (1)Windows Export Certificate T1552.004, T1649