Suspicious X509Enrollment - Ps Script

Title: Suspicious X509Enrollment - Ps Script
Status: test
Description:Detect use of X509Enrollment
References:
  -https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=42
  -https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=41
  -https://learn.microsoft.com/en-us/dotnet/api/microsoft.hpc.scheduler.store.cx509enrollmentwebclassfactoryclass?view=hpc-sdk-5.1.6115
Author: frack113
Date: 2022-12-23
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1553.004'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains:
      -'X509Enrollment.CBinaryConverter'
      -'884e2002-217d-11da-b2a4-000e7bbb2b09'

  condition:selection
Falsepositives:
  -Legitimate administrative script
Level: medium