PowerShell ConvertTo-SecureString Cmdlet Execution from Command Line (Windows)

Alerts when PowerShell is launched with a command line containing ConvertTo-SecureString, a credential-related cmdlet uncommon in normal execution.

FreeUnreviewedSigmamediumv1

powershell-convertto-securestring-cmdlet-execution-from-command-line-windows-74403157

title: PowerShell ConvertTo-SecureString Cmdlet Execution from Command Line (Windows)
id: d3cb4a14-ca4d-4d38-9062-17617f269a44
status: test
description: This rule identifies process executions of PowerShell (powershell.exe or pwsh.exe) where the command line contains the ConvertTo-SecureString cmdlet. Attackers may use this cmdlet to handle credentials or reduce the visibility of sensitive values during PowerShell-driven actions. The detection relies on process creation telemetry, specifically the process image path and the command-line string.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/convertto-securestring?view=powershell-7.3#examples
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_cmdline_convertto_securestring.yml
author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton, Huntrule Team
date: 2020-10-11
modified: 2023-02-01
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_cli:
    CommandLine|contains: ConvertTo-SecureString
  condition: all of selection_*
falsepositives:
  - Legitimate use to pass password to different powershell commands
level: medium
license: DRL-1.1
related:
  - id: 74403157-20f5-415d-89a7-c505779585cf
    type: derived

What it detects

This rule identifies process executions of PowerShell (powershell.exe or pwsh.exe) where the command line contains the ConvertTo-SecureString cmdlet. Attackers may use this cmdlet to handle credentials or reduce the visibility of sensitive values during PowerShell-driven actions. The detection relies on process creation telemetry, specifically the process image path and the command-line string.

Known false positives

Legitimate use to pass password to different powershell commands

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.