Windows PowerShell script uses SslStream with client authentication and cert validation callback

Flags PowerShell scripts referencing SslStream and client-side certificate validation during SSL client authentication.

FreeUnreviewedSigmalowv1

windows-powershell-script-uses-sslstream-with-client-authentication-and-cert-val-195626f3

title: Windows PowerShell script uses SslStream with client authentication and cert validation callback
id: ef26b1a4-ef4a-426f-ab74-fe75fe191c37
status: test
description: This rule identifies PowerShell script content that creates an SSL/TLS client stream using System.Net.Security.SslStream and client authentication via .AuthenticateAsClient, while also defining Net.Security.RemoteCertificateValidationCallback. Attackers can use these API calls to establish encrypted channels that can conceal command-and-control traffic from casual inspection. The detection relies on Script Block Logging telemetry capturing the script text containing these specific .NET API elements.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1573/T1573.md#atomic-test-1---openssl-c2
  - https://medium.com/walmartglobaltech/openssl-server-reverse-shell-from-windows-client-aee2dbfa0926
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_ssl_keyword.yml
author: frack113, Huntrule Team
date: 2022-01-23
tags:
  - attack.command-and-control
  - attack.t1573
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - System.Net.Security.SslStream
      - Net.Security.RemoteCertificateValidationCallback
      - .AuthenticateAsClient
  condition: selection
falsepositives:
  - Legitimate administrative script
level: low
license: DRL-1.1
related:
  - id: 195626f3-5f1b-4403-93b7-e6cfd4d6a078
    type: derived

What it detects

This rule identifies PowerShell script content that creates an SSL/TLS client stream using System.Net.Security.SslStream and client authentication via .AuthenticateAsClient, while also defining Net.Security.RemoteCertificateValidationCallback. Attackers can use these API calls to establish encrypted channels that can conceal command-and-control traffic from casual inspection. The detection relies on Script Block Logging telemetry capturing the script text containing these specific .NET API elements.

Known false positives

Legitimate administrative script

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.