PowerShell Process Command Line Uses System.Security.Cryptography Classes

Alerts on PowerShell executions that reference System.Security.Cryptography and common crypto class names.

FreeUnreviewedSigmamediumv1

powershell-process-command-line-uses-system-security-cryptography-classes-ad856965

title: PowerShell Process Command Line Uses System.Security.Cryptography Classes
id: 4d1f81dc-87e5-4b69-b5be-c2736e28a7a1
status: test
description: This rule flags process executions of PowerShell (powershell.exe or pwsh.exe) whose command line references the .NET namespace System.Security.Cryptography and specific cryptography class names. Attackers may leverage these APIs to perform encryption or decryption as part of defense evasion, including runtime handling of protected payloads. The detection relies on Windows process creation telemetry, matching on the PowerShell image path and substring patterns within the command line.
references:
  - https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography?view=net-8.0
  - https://blogs.vmware.com/security/2023/11/jupyter-rising-an-update-on-jupyter-infostealer.html
  - https://www.virustotal.com/gui/file/39102fb7bb6a74a9c8cb6d46419f9015b381199ea8524c1376672b30fffd69d2
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_powershell_crypto_namespace.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2023-12-01
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.001
  - attack.t1027.010
  - detection.threat-hunting
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_cmdlet_namespace:
    CommandLine|contains: System.Security.Cryptography.
  selection_cmdlet_classes:
    CommandLine|contains:
      - .AesCryptoServiceProvider
      - .DESCryptoServiceProvider
      - .DSACryptoServiceProvider
      - .RC2CryptoServiceProvider
      - .Rijndael
      - .RSACryptoServiceProvider
      - .TripleDESCryptoServiceProvider
  condition: all of selection_*
falsepositives:
  - Classes are legitimately used, but less so when e.g. parents with low prevalence or decryption of content in temporary folders.
level: medium
license: DRL-1.1
related:
  - id: ad856965-f44d-42a8-945e-bbf7bd03d05a
    type: derived

What it detects

This rule flags process executions of PowerShell (powershell.exe or pwsh.exe) whose command line references the .NET namespace System.Security.Cryptography and specific cryptography class names. Attackers may leverage these APIs to perform encryption or decryption as part of defense evasion, including runtime handling of protected payloads. The detection relies on Windows process creation telemetry, matching on the PowerShell image path and substring patterns within the command line.

Known false positives

Classes are legitimately used, but less so when e.g. parents with low prevalence or decryption of content in temporary folders.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.