Windows PowerShell: Suspicious SslStream Client Certificate Validation in Script Block

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1573Encrypted Channel
Exfiltration
Impact

What it detects

This rule flags PowerShell script blocks that use .NET SslStream client-side authentication with explicit remote certificate validation callbacks. Attackers can use these APIs to establish encrypted channels for command and control while handling certificates in code. The detection relies on PowerShell Script Block Logging and matches specific .NET method and callback strings within the logged script content.

Reporting behind it

Related detections5 linkedT1573 — drag to rearrange

Malicious OysterLoader C2 Beacon Using WordPressAgent User Agent

Windows curl.exe SOCKS Proxy and .onion Command-Line Execution

Microsoft Cloud App Security: Alerts for Successful Activity from Infrequent Countries

Microsoft Cloud App Security: Activity from Microsoft Threat Intelligence Risky IPs

M365 Threat Management: Activity from Anonymous Proxy IP Addresses

Windows PowerShell: Suspicious SslStream Client Certificate Validation in Script Block

Pivot detection · T1573 · 5 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-script-uses-sslstream-with-client-authentication-and-cert-val-195626f3

title: "Windows PowerShell: Suspicious SslStream Client Certificate Validation in Script Block"
id: ef26b1a4-ef4a-426f-ab74-fe75fe191c37
status: test
description: This rule flags PowerShell script blocks that use .NET SslStream client-side authentication with explicit remote certificate validation callbacks. Attackers can use these APIs to establish encrypted channels for command and control while handling certificates in code. The detection relies on PowerShell Script Block Logging and matches specific .NET method and callback strings within the logged script content.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1573/T1573.md#atomic-test-1---openssl-c2
  - https://medium.com/walmartglobaltech/openssl-server-reverse-shell-from-windows-client-aee2dbfa0926
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_ssl_keyword.yml
author: frack113, Huntrule Team
date: 2022-01-23
tags:
  - attack.command-and-control
  - attack.t1573
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - System.Net.Security.SslStream
      - Net.Security.RemoteCertificateValidationCallback
      - .AuthenticateAsClient
  condition: selection
falsepositives:
  - Legitimate administrative script
level: low
license: DRL-1.1
related:
  - id: 195626f3-5f1b-4403-93b7-e6cfd4d6a078
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL