CmdID / PowerShell / Cmdlets / Unprotect
Unprotect-CmsMessage
Decrypts content that has been encrypted by using the Cryptographic Message Syntax format. PowerShell reference
From the PowerShell reference 6 parameters
What it does
Decrypts content that has been encrypted by using the Cryptographic Message Syntax format. The Unprotect-CmsMessage cmdlet decrypts content that has been encrypted using the Cryptographic Message Syntax (CMS) format. The CMS cmdlets support encryption and decryption of content using the IETF standard format for cryptographically protecting messages, as documented by RFC5652. The CMS encryption standard uses public key cryptography, where the keys used to encrypt content (the public key) and the keys used to decrypt content (the private key) are separate. Your public key can be shared widely, and isn't sensitive data. If any content is encrypted with this public key, only your private key can decrypt it. For more information, see Public-key cryptography. Unprotect-CmsMessage decrypts content that has been encrypted in CMS format. You can run this cmdlet to decrypt content that you have encrypted by running the Protect-CmsMessage cmdlet. You can specify content that you want to decrypt as a string, by the encryption event log record ID number, or by path to the encrypted content. The Unprotect-CmsMessage cmdlet returns the decrypted content. Support for Linux and macOS was added in PowerShell 7.1.
Unprotect-CmsMessage [-EventLogRecord] <EventLogRecord> [[-To] <CmsMessageRecipient[]>] [-IncludeContext] [<CommonParameters>]Unprotect-CmsMessage [-Content] <string> [[-To] <CmsMessageRecipient[]>] [-IncludeContext] [<CommonParameters>]Unprotect-CmsMessage [-Path] <string> [[-To] <CmsMessageRecipient[]>] [-IncludeContext] [<CommonParameters>]Unprotect-CmsMessage [-LiteralPath] <string> [[-To] <CmsMessageRecipient[]>] [-IncludeContext] [<CommonParameters>]Decrypt a message
$parameters = @{
LiteralPath = "C:\Users\Test\Documents\PowerShell\Future_Plans.txt"
To = '0f 8j b1 ab e0 ce 35 1d 67 d2 f2 6f a2 d2 00 cl 22 z9 m9 85'
}
Unprotect-CmsMessage -LiteralPath @parametersIdentifyDecrypt an encrypted event log message
$event = Get-WinEvent Microsoft-Windows-PowerShell/Operational -MaxEvents 1 |
Where-Object Id -EQ 4104
Unprotect-CmsMessage -EventLogRecord $eventIdentifyTrips 2 Sigma rules: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems); mediumPotentially Suspicious EventLog Recon Activity Using Log Query Utilities by Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
Decrypt encrypted event log messages using the pipeline
Get-WinEvent Microsoft-Windows-PowerShell/Operational |
Where-Object Id -EQ 4104 |
Unprotect-CmsMessageIdentifyTrips 2 Sigma rules: mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems); mediumPotentially Suspicious EventLog Recon Activity Using Log Query Utilities by Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
Its page in the reference: Unprotect-CmsMessage.
Parameters
-ContentSpecifies an encrypted string, or a variable containing an encrypted string.-EventLogRecordSpecifies an event log record that contains a CMS encrypted message.-IncludeContextDetermines whether to include the decrypted content in its original context, rather than output the decrypted content only.-LiteralPathSpecifies the path to encrypted content that you want to decrypt. Unlike Path, the value of LiteralPath is used exactly as it's typed. No characters are interpreted as wildcard characters. If the path includes escape characters, enclose it in single quotation marks. Single quotation marks tell PowerShell not to interpret any characters as escape sequences.-PathSpecifies the path to encrypted content that you want to decrypt.-ToSpecifies one or more CMS message recipients, identified in any of the following formats:
- An actual certificate (as retrieved from the Certificate provider).
- Path to the a file containing the certificate.
- Path to a directory containing the certificate.
- Thumbprint of the certificate (used to look in the certificate store).
- Subject name of the certificate (used to look in the certificate store).