Script derives a cryptographic key from a machine identifier

1title: Script derives a cryptographic key from a machine identifier2id: 66d66665-7a21-47d5-8d0c-6579711673553status: experimental4description: |5  Environmental keying is a burst of discovery followed by a decryption whose key6  is derived from what the discovery found, and the count-over-a-window part of7  AN1305 has no Sigma construct, so this rule requires the two halves that do fit8  inside a single script block — a read of a machine-identifying value and a call9  into a cryptographic primitive that could turn that value into a key. The corpus10  rule for the parent technique T1480 matches the conditional form of a guardrail11  on a process command line, an identity read next to a comparison operator; this12  one matches the cryptographic form in script text, so the two cover different13  halves of the behaviour rather than repeating each other. The brief's PowerShell14  log source spans EventID 4103 through 4106 and this rule is written in the 410415  vocabulary, gating on that EventID because ScriptBlockText exists only there —16  4103 carries Payload and ContextInfo instead and would need a field mapping17  before it could feed the same logic. Script Block Logging is off in a default18  install and in the vendor and CIS baselines, so unless it has been enabled there19  is no 4104 at all and this returns zero rows while appearing healthy. Treat a20  match as a hunting lead, not an alert: co-occurrence of the two vocabularies in21  one block is textually identical whether an operator is deriving a key to unlock22  a payload or an ops script is protecting a secret with the machine's own DPAPI23  store, and nothing else in a 4104 event separates them. The level is set to what24  the first false positive below supports, not to the severity of the technique.25  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0474, not hand-written and not tested by its author. Any lab result is on this rule's own page.26references:27  - https://attack.mitre.org/techniques/T1480/00128  - https://attack.mitre.org/detectionstrategies/DET047429author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)30date: 2026-08-1631tags:32  - attack.defense-evasion33  - attack.t1480.00134logsource:35  product: windows36  service: powershell37detection:38  selection_event:39    EventID: 410440  selection_identity:41    ScriptBlockText|contains:42      - 'env:COMPUTERNAME'43      - 'env:USERDOMAIN'44      - 'env:USERDNSDOMAIN'45      - 'env:LOGONSERVER'46      - 'Win32_ComputerSystemProduct'47      - 'Win32_BIOS'48      - 'Win32_NetworkAdapterConfiguration'49      - 'MachineGuid'50      - 'GetHostByName'51      - 'Get-ADDomain'52  selection_crypto:53    ScriptBlockText|contains:54      - 'System.Security.Cryptography'55      - 'AesManaged'56      - 'AesCryptoServiceProvider'57      - 'RijndaelManaged'58      - 'CreateDecryptor'59      - 'DeriveBytes'60      - 'ComputeHash'61      - 'ConvertTo-SecureString'62  condition: selection_event and selection_identity and selection_crypto63falsepositives:64  - "Plain DPAPI secret handling — ConvertTo-SecureString -AsPlainText piped into ConvertFrom-SecureString with no -Key — which is the default and ubiquitous way to store a credential on a Windows host. Any such script that also logs or stamps the computer name or the domain in the same block matches, and this is the most common PowerShell idiom the rule will ever see."65  - "Software inventory, licensing and device-enrolment scripts, which build a machine fingerprint by hashing the hardware UUID, the machine GUID or the computer name. Where such a script runs on a schedule it recurs on every host in the estate."66  - "Configuration management and packaging frameworks that protect a secret with a machine-bound key. Desired State Configuration, installer wrappers and deployment scripts routinely call ConvertTo-SecureString or a key-derivation routine in the same script block that reads the computer name or the domain."67  - "Backup, endpoint-protection and remote-management agents shipping PowerShell modules that checksum collected system information before uploading it, which reads as an identity value flowing into a hash."68  - "Administrators writing an ad-hoc script that queries the hardware details and hashes the result to produce a per-host identifier for an asset register or a licence check."69level: low