CmdID / PowerShell / Cmdlets / ConvertTo
ConvertTo-SecureString
Converts plain text or encrypted strings to secure strings. PowerShell reference
From the PowerShell reference 5 parameters 1 Sigma rule looks for it
What it does
Converts plain text or encrypted strings to secure strings. The ConvertTo-SecureString cmdlet converts encrypted standard strings into secure strings. It can also convert plain text to secure strings. It is used with ConvertFrom-SecureString and Read-Host. The secure string created by the cmdlet can be used with cmdlets or functions that require a parameter of type SecureString. The secure string can be converted back to an encrypted, standard string using the ConvertFrom-SecureString cmdlet. This enables it to be stored in a file for later use. If the standard string being converted was encrypted with ConvertFrom-SecureString using a specified key, that same key must be provided as the value of the Key or SecureKey parameter of the ConvertTo-SecureString cmdlet. If you don't specify a key when creating the secure string, the string is encrypted by the Windows Data Protection API (DPAPI). NOTE: For more information about SecureString data protection, see How secure is SecureString?.
ConvertTo-SecureString [-String] <String> [[-SecureKey] <SecureString>] [<CommonParameters>]ConvertTo-SecureString [-String] <String> [-AsPlainText] [-Force] [<CommonParameters>]ConvertTo-SecureString [-String] <String> [-Key <Byte[]>] [<CommonParameters>]Convert a secure string to an encrypted string
PS C:> $Secure = Read-Host -AsSecureString
PS C:> $Secure
System.Security.SecureString
PS C:> $Encrypted = ConvertFrom-SecureString -SecureString $Secure
PS C:> $Encrypted
01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a114d45b8dd3f4aa11ad7c0abdae98000000000
02000000000003660000a8000000100000005df63cea84bfb7d70bd6842e7efa79820000000004800000a000
000010000000f10cd0f4a99a8d5814d94e0687d7430b100000008bf11f1960158405b2779613e9352c6d1400
0000e6b7bf46a9d485ff211b9b2a2df3bd6eb67aae41
PS C:> $Secure2 = ConvertTo-SecureString -String $Encrypted
PS C:> $Secure2
System.Security.SecureStringIdentifyTrips 1 Sigma rule: mediumConvertTo-SecureString Cmdlet Usage Via CommandLine by Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton
Create a secure string from an encrypted string in a file
$Secure = Read-Host -AsSecureString
$Encrypted = ConvertFrom-SecureString -SecureString $Secure -Key (1..16)
$Encrypted | Set-Content Encrypted.txt
$Secure2 = Get-Content Encrypted.txt | ConvertTo-SecureString -Key (1..16)IdentifyTrips 1 Sigma rule: mediumConvertTo-SecureString Cmdlet Usage Via CommandLine by Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton
Convert a plain text string to a secure string
$Secure_String_Pwd = ConvertTo-SecureString "P@ssW0rD!" -AsPlainText -ForceIdentifyTrips 2 Sigma rules: mediumConvertTo-SecureString Cmdlet Usage Via CommandLine by Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton; mediumWeak or Abused Passwords In CLI by Nasreddine Bencherchali (Nextron Systems)
Its page in the reference: ConvertTo-SecureString.
Parameters
-AsPlainTextSpecifies a plain text string to convert to a secure string. The secure string cmdlets help protect confidential text. The text is encrypted for privacy and is deleted from computer memory after it is used. If you use this parameter to provide plain text as input, the system cannot protect that input in this manner. To use this parameter, you must also specify the Force parameter.-ForceConfirms that you understand the implications of using the AsPlainText parameter and still want to use it.-KeySpecifies the encryption key used to convert the original secure string into the encrypted standard string. Valid key lengths are 16, 24 and 32 bytes. If the key doesn't match the key used to encrypt the original secure string, the value returned is invalid. If the encrypted string was created without a key, you shouldn't use a key to convert it back to a secure string.-SecureKeySpecifies the encryption key used to convert the original secure string into the encrypted standard string. The key must be provided in the format of a secure string. Valid secure key lengths are 8, 12 and 16 code points. If the key doesn't match the key used to encrypt the original secure string, the value returned is invalid. If the encrypted string was created without a key, you shouldn't use a key to convert it back to a secure string.-StringSpecifies the string to convert to a secure string.