Windows Process Creation: Suspicious X509Enrollment.CBinaryConverter Execution
Alerts on Windows command lines referencing X509Enrollment.CBinaryConverter with a specific GUID.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-12-23
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the command line contains the X509Enrollment.CBinaryConverter string and the identifier 884e2002-217d-11da-b2a4-000e7bbb2b09. Attackers may misuse X509Enrollment-related components to obtain or manipulate certificate functionality through signed-in system processes. The detection relies on process command-line telemetry from Windows process creation logs.
Reporting behind it
- speakerdeck.comhttps://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=42
- speakerdeck.comhttps://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=41
- learn.microsoft.comhttps://learn.microsoft.com/en-us/dotnet/api/microsoft.hpc.scheduler.store.cx509enrollmentwebclassfactoryclass?view=hpc-sdk-5.1.6115
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_x509enrollment.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Suspicious X509Enrollment.CBinaryConverter Execution"
id: fc237abc-1e7c-4a28-8304-e193fc97ec91
related:
- id: 504d63cb-0dba-4d02-8531-e72981aace2c
type: similar
- id: 114de787-4eb2-48cc-abdb-c0b449f93ea4
type: derived
status: test
description: This rule flags Windows process creation events where the command line contains the X509Enrollment.CBinaryConverter string and the identifier 884e2002-217d-11da-b2a4-000e7bbb2b09. Attackers may misuse X509Enrollment-related components to obtain or manipulate certificate functionality through signed-in system processes. The detection relies on process command-line telemetry from Windows process creation logs.
references:
- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=42
- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=41
- https://learn.microsoft.com/en-us/dotnet/api/microsoft.hpc.scheduler.store.cx509enrollmentwebclassfactoryclass?view=hpc-sdk-5.1.6115
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_x509enrollment.yml
author: frack113, Huntrule Team
date: 2022-12-23
tags:
- attack.defense-impairment
- attack.t1553.004
logsource:
product: windows
category: process_creation
detection:
selection:
CommandLine|contains:
- X509Enrollment.CBinaryConverter
- 884e2002-217d-11da-b2a4-000e7bbb2b09
condition: selection
falsepositives:
- Legitimate administrative script
level: medium
license: DRL-1.1