Suspicious X509Enrollment in PowerShell Script

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

This rule detects the use of 'X509Enrollment' objects within PowerShell scripts. Adversaries may use X509Enrollment to install root certificates, which can be leveraged to bypass security warnings when connecting to adversary-controlled web servers or to sign malicious code, thereby subverting trust controls and enabling defense evasion.