Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials.

Tactics
TA0006

Sub-technique of
T1552


See: MITRE ATT&CK