Windows Process Creation: Suspicious X509Enrollment.CBinaryConverter Execution

Alerts on Windows command lines referencing X509Enrollment.CBinaryConverter with a specific GUID.

FreeUnreviewedSigmamediumv1

windows-process-creation-suspicious-x509enrollment-cbinaryconverter-execution-114de787

title: "Windows Process Creation: Suspicious X509Enrollment.CBinaryConverter Execution"
id: fc237abc-1e7c-4a28-8304-e193fc97ec91
related:
  - id: 504d63cb-0dba-4d02-8531-e72981aace2c
    type: similar
  - id: 114de787-4eb2-48cc-abdb-c0b449f93ea4
    type: derived
status: test
description: This rule flags Windows process creation events where the command line contains the X509Enrollment.CBinaryConverter string and the identifier 884e2002-217d-11da-b2a4-000e7bbb2b09. Attackers may misuse X509Enrollment-related components to obtain or manipulate certificate functionality through signed-in system processes. The detection relies on process command-line telemetry from Windows process creation logs.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=42
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=41
  - https://learn.microsoft.com/en-us/dotnet/api/microsoft.hpc.scheduler.store.cx509enrollmentwebclassfactoryclass?view=hpc-sdk-5.1.6115
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_x509enrollment.yml
author: frack113, Huntrule Team
date: 2022-12-23
tags:
  - attack.defense-impairment
  - attack.t1553.004
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - X509Enrollment.CBinaryConverter
      - 884e2002-217d-11da-b2a4-000e7bbb2b09
  condition: selection
falsepositives:
  - Legitimate administrative script
level: medium
license: DRL-1.1

What it detects

This rule flags Windows process creation events where the command line contains the X509Enrollment.CBinaryConverter string and the identifier 884e2002-217d-11da-b2a4-000e7bbb2b09. Attackers may misuse X509Enrollment-related components to obtain or manipulate certificate functionality through signed-in system processes. The detection relies on process command-line telemetry from Windows process creation logs.

Known false positives

Legitimate administrative script

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.