ConvertTo-SecureString Cmdlet Usage Via CommandLine
A Sigma rule for process creation on Windows, by Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton.
medium 2 ATT&CK techniques 2 programs it names 4 everyday examples trip it
What it looks for
detection:
selection_cli:
CommandLine|contains: 'ConvertTo-SecureString'
selection_img:
- Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- OriginalFileName:
- 'PowerShell.EXE'
- 'pwsh.dll'
condition: all of selection_*
The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.
Command lines that trip it
Add a computer to a domain using predefined computer credentials on the page for Add-Computer
$newADComputerSplat = @{
Name = "Server02"
AccountPassword = (ConvertTo-SecureString -String 'TempJoinPA$$' -AsPlainText -Force)
}
New-ADComputer @newADComputerSplat
# Then this command is run from Server02 which is not yet domain-joined:
$joinCred = New-Object pscredential -ArgumentList ([pscustomobject]@{
UserName = $null
Password = (ConvertTo-SecureString -String 'TempJoinPA$$' -AsPlainText -Force)[0]
})
$addComputerSplat = @{
DomainName = "Domain03"
Options = 'UnsecuredJoin', 'PasswordPass'
Credential = $joinCred
}
Add-Computer @addComputerSplatIdentifyConvert a secure string to an encrypted string on the page for ConvertTo-SecureString
PS C:> $Secure = Read-Host -AsSecureString
PS C:> $Secure
System.Security.SecureString
PS C:> $Encrypted = ConvertFrom-SecureString -SecureString $Secure
PS C:> $Encrypted
01000000d08c9ddf0115d1118c7a00c04fc297eb010000001a114d45b8dd3f4aa11ad7c0abdae98000000000
02000000000003660000a8000000100000005df63cea84bfb7d70bd6842e7efa79820000000004800000a000
000010000000f10cd0f4a99a8d5814d94e0687d7430b100000008bf11f1960158405b2779613e9352c6d1400
0000e6b7bf46a9d485ff211b9b2a2df3bd6eb67aae41
PS C:> $Secure2 = ConvertTo-SecureString -String $Encrypted
PS C:> $Secure2
System.Security.SecureStringIdentifyCreate a secure string from an encrypted string in a file on the page for ConvertTo-SecureString
$Secure = Read-Host -AsSecureString
$Encrypted = ConvertFrom-SecureString -SecureString $Secure -Key (1..16)
$Encrypted | Set-Content Encrypted.txt
$Secure2 = Get-Content Encrypted.txt | ConvertTo-SecureString -Key (1..16)IdentifyConvert a plain text string to a secure string on the page for ConvertTo-SecureString
$Secure_String_Pwd = ConvertTo-SecureString "P@ssW0rD!" -AsPlainText -ForceIdentify