PowerShell SslStream Encrypted Connection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•42

This rule detects PowerShell script blocks that utilize .NET's SslStream for establishing encrypted network connections. Specifically, it looks for the use of 'System.Net.Security.SslStream', 'Net.Security.RemoteCertificateValidationCallback', and '.AuthenticateAsClient' which are indicative of a client-side SSL/TLS connection being programmatically established, potentially for command and control (C2) purposes to evade detection.