Suspicious Windows PowerShell: X509Enrollment .CBinaryConverter Usage

Alerts on PowerShell script blocks containing X509Enrollment.CBinaryConverter and a specific enrollment GUID.

FreeUnreviewedSigmamediumv1

suspicious-windows-powershell-x509enrollment-cbinaryconverter-usage-504d63cb

title: "Suspicious Windows PowerShell: X509Enrollment .CBinaryConverter Usage"
id: 99723f29-1275-4756-a2b4-8bce5c0cd04d
related:
  - id: 114de787-4eb2-48cc-abdb-c0b449f93ea4
    type: similar
  - id: 504d63cb-0dba-4d02-8531-e72981aace2c
    type: derived
status: test
description: This rule flags PowerShell script blocks that reference the X509Enrollment .CBinaryConverter and a specific enrollment GUID (884e2002-217d-11da-b2a4-000e7bbb2b09). Attackers can use X509Enrollment-related calls to interact with certificate functionality from scripts, which can support stealthy abuse of trusted infrastructure. The detection relies on PowerShell Script Block Logging telemetry capturing the script text content.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=42
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=41
  - https://learn.microsoft.com/en-us/dotnet/api/microsoft.hpc.scheduler.store.cx509enrollmentwebclassfactoryclass?view=hpc-sdk-5.1.6115
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_x509enrollment.yml
author: frack113, Huntrule Team
date: 2022-12-23
tags:
  - attack.defense-impairment
  - attack.t1553.004
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - X509Enrollment.CBinaryConverter
      - 884e2002-217d-11da-b2a4-000e7bbb2b09
  condition: selection
falsepositives:
  - Legitimate administrative script
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell script blocks that reference the X509Enrollment .CBinaryConverter and a specific enrollment GUID (884e2002-217d-11da-b2a4-000e7bbb2b09). Attackers can use X509Enrollment-related calls to interact with certificate functionality from scripts, which can support stealthy abuse of trusted infrastructure. The detection relies on PowerShell Script Block Logging telemetry capturing the script text content.

Known false positives

Legitimate administrative script

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.