Script derives a cryptographic key from a machine identifier

Siemphony@siemphonylowT1480.001unverified

Environmental keying is a burst of discovery followed by a decryption whose key is derived from what the discovery found, and the count-over-a-window part of AN1305 has no Sigma construct, so this rule requires the two halves that do fit inside a single script block — a read of a machine-identifying value and a call into a cryptographic primitive that could turn that value into a key. The corpus rule for the parent technique T1480 matches the conditional form of a guardrail on a process command line, an identity read next to a comparison operator; this one matches the cryptographic form in script text, so the two cover different halves of the behaviour rather than repeating each other. The brief's PowerShell log source spans EventID 4103 through 4106 and this rule is written in the 4104 vocabulary, gating on that EventID because ScriptBlockText exists only there — 4103 carries Payload and ContextInfo instead and would need a field mapping before it could feed the same logic. Script Block Logging is off in a default install and in the vendor and CIS baselines, so unless it has been enabled there is no 4104 at all and this returns zero rows while appearing healthy. Treat a match as a hunting lead, not an alert: co-occurrence of the two vocabularies in one block is textually identical whether an operator is deriving a key to unlock a payload or an ops script is protecting a secret with the machine's own DPAPI store, and nothing else in a 4104 event separates them. The level is set to what the first false positive below supports, not to the severity of the technique. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0474, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

Event| where ((EventID == 4104 and (ScriptBlockText contains "env:COMPUTERNAME" or ScriptBlockText contains "env:USERDOMAIN" or ScriptBlockText contains "env:USERDNSDOMAIN" or ScriptBlockText contains "env:LOGONSERVER" or ScriptBlockText contains "Win32_ComputerSystemProduct" or ScriptBlockText contains "Win32_BIOS" or ScriptBlockText contains "Win32_NetworkAdapterConfiguration" or ScriptBlockText contains "MachineGuid" or ScriptBlockText contains "GetHostByName" or ScriptBlockText contains "Get-ADDomain")) and (ScriptBlockText contains "System.Security.Cryptography" or ScriptBlockText contains "AesManaged" or ScriptBlockText contains "AesCryptoServiceProvider" or ScriptBlockText contains "RijndaelManaged" or ScriptBlockText contains "CreateDecryptor" or ScriptBlockText contains "DeriveBytes" or ScriptBlockText contains "ComputeHash" or ScriptBlockText contains "ConvertTo-SecureString"))

Splunk · SPL

Run this as a search.

index=* ((EventID="4104" AND (ScriptBlockText="*env:COMPUTERNAME*" OR ScriptBlockText="*env:USERDOMAIN*" OR ScriptBlockText="*env:USERDNSDOMAIN*" OR ScriptBlockText="*env:LOGONSERVER*" OR ScriptBlockText="*Win32_ComputerSystemProduct*" OR ScriptBlockText="*Win32_BIOS*" OR ScriptBlockText="*Win32_NetworkAdapterConfiguration*" OR ScriptBlockText="*MachineGuid*" OR ScriptBlockText="*GetHostByName*" OR ScriptBlockText="*Get-ADDomain*")) AND (ScriptBlockText="*System.Security.Cryptography*" OR ScriptBlockText="*AesManaged*" OR ScriptBlockText="*AesCryptoServiceProvider*" OR ScriptBlockText="*RijndaelManaged*" OR ScriptBlockText="*CreateDecryptor*" OR ScriptBlockText="*DeriveBytes*" OR ScriptBlockText="*ComputeHash*" OR ScriptBlockText="*ConvertTo-SecureString*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((event.code == 4104 AND (TO_LOWER(powershell.file.script_block_text) LIKE "*env:computername*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*env:userdomain*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*env:userdnsdomain*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*env:logonserver*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*win32_computersystemproduct*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*win32_bios*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*win32_networkadapterconfiguration*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*machineguid*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*gethostbyname*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*get-addomain*")) AND (TO_LOWER(powershell.file.script_block_text) LIKE "*system.security.cryptography*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*aesmanaged*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*aescryptoserviceprovider*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*rijndaelmanaged*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*createdecryptor*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*derivebytes*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*computehash*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*convertto-securestring*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4104$</field>    <field name="ScriptBlockText" type="pcre2">(?i)(env:COMPUTERNAME|env:USERDOMAIN|env:USERDNSDOMAIN|env:LOGONSERVER|Win32_ComputerSystemProduct|Win32_BIOS|Win32_NetworkAdapterConfiguration|MachineGuid|GetHostByName|Get-ADDomain)</field>    <field name="ScriptBlockText" type="pcre2">(?i)(System\.Security\.Cryptography|AesManaged|AesCryptoServiceProvider|RijndaelManaged|CreateDecryptor|DeriveBytes|ComputeHash|ConvertTo-SecureString)</field>    <description>Script derives a cryptographic key from a machine identifier</description>    <mitre>      <id>T1480.001</id>    </mitre>  </rule></group>

At a glance

Logsource: powershell / windows
Level: low
Category: obfuscated_payloads
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 66d66665-7a21-47d5-8d0c-657971167355

ATT&CKT1480.001

T1480.001Environmental Keying

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonobfuscated payloads

obfuscated payloads

01 · What this rule detects

Content made deliberately unreadable before it runs — a base64 or hex blob passed on a command line, a script assembled from concatenated fragments, a packed or encrypted file on disk, and the decode step that has to happen before any of it executes. The obfuscation itself is not the finding; the transition from encoded to executed is. Guardrailed payloads belong here too, where the key is derived from the victim's domain or hostname so the content only decodes on the intended machine and never in your sandbox.

02 · Telemetry you need

Sysmon EventID 1 CommandLine, ParentImage and OriginalFileName, complete and untruncated — Security 4688 needs Audit Process Creation for the event and the separate 'Include command line in process creation events' policy for the arguments, and without the second one you get the image name and none of the encoding
PowerShell script block logging (EventID 4104), which records the content after decoding — off by default, and long blocks are split across several events with MessageNumber and MessageTotal, so a contains match on one event misses any string that straddles the split
Sysmon EventID 11 (FileCreate) for the decoded payload written to disk and EventID 7 (ImageLoad) for what is loaded straight afterwards — a reflectively loaded module produces no EventID 7 at all, so absence here proves nothing
auditd execve records on Linux — the rule must be loaded in /etc/audit/rules.d or nothing is captured, and any argument containing whitespace or non-printable characters is written hex-encoded rather than as text, so a match written against the plaintext string silently never fires
Antimalware Scan Interface telemetry where your endpoint product exposes it: it sees the buffer after decoding, but only for the runtimes that call it — PowerShell, the Windows Script Host, VBA and .NET — never a native loader

03 · How the logic works

Start with the trap, because it is the reason most rules in this category are unusable: base64 on a command line is overwhelmingly benign. Installers pass encoded configuration, telemetry agents pass encoded payloads, deployment tooling ships whole scripts as -EncodedCommand, and scheduled tasks are registered with base64 arguments by products nobody considers suspicious. 'Contains base64' and 'high entropy' are therefore not detections — entropy measures compressibility, not intent, and certificates, GUIDs, JWTs, minified JavaScript and packed commercial binaries all score exactly as high as a packed implant. Entropy is a ranking signal for triage, not a firing condition.

What makes it a detection is base64 plus a decode-and-execute pair in the same command line or the same script block: FromBase64String alongside Invoke-Expression, IEX or .Invoke(); certutil -decode followed by execution of what it wrote; base64 -d piped into sh or bash; eval over a decoded string. Match the pair, not the blob. One useful specific: -EncodedCommand payloads are UTF-16LE before encoding, so a decoded ASCII keyword appears as a predictable base64 fragment — but the fragment depends on the byte offset the string starts at, so you need all three alignments of each keyword or the match is a coin flip.

The second family is character-level obfuscation rather than encoding: carets in cmd, backticks and the format operator in PowerShell, %VAR:~n,m% substring expansion, quotes inserted mid-token, variables assembled and then invoked. Match density rather than presence. One caret is a normal escape; fifteen carets in one command line is not a command line anyone typed. Finally, execution guardrails cap what any of this can achieve: if the key is derived from the environment, you may never observe the decoded content at all, and the guardrail check is made of ordinary API calls that make a poor rule. That is an argument for keeping the file-write and image-load rules alongside the command-line ones, not for writing a rule against the guardrail.

04 · Common false positives

Intune, Configuration Manager and similar deployment platforms, which run detection and remediation scripts as -EncodedCommand by design — this is normally the single highest-volume match in the category
certutil -encode and -decode used by administrators and certificate enrolment scripts to move certificate material around as text
Monitoring, backup and inventory agents that register scheduled tasks with a base64 argument, then run them on a fixed schedule from every host in the estate
Minified and bundled JavaScript, source maps and web application build output, which trip entropy and long-string rules written against file content
Commercially packed and protected binaries — DRM wrappers, anti-cheat, licence protection — whose sections have the same entropy profile as a packer because they are one
Cloud and container CLI usage, where secrets, kubeconfigs and manifests are routinely base64 on the command line

05 · Detection maturity

Tier 1 — starting point: Matches -EncodedCommand and similar encoding flags, or a base64-shaped string, anywhere on a command line.
Tier 2 — tuned: Requires encoding together with a decode-and-execute pair or a high density of escape characters, with deployment tooling excluded by signed parent path.
Tier 3 — correlated: Reads the decoded content from script block logging or enrichment and scores on what the decoded command actually does, the parent chain, and whether the payload was written to disk or loaded in memory afterwards.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Require the pair: encoding plus a decode call plus an execution sink. A rule that fires on the encoding alone will be turned off within a week and will have taught the author that the category does not work
Exclude deployment tooling by the full signed path of the parent process, never by the encoded string — the string is the attacker's half and the parent is not
Match parameter prefixes case-insensitively and cover the dash variants: PowerShell accepts -e, -en, -enc and any longer prefix of -EncodedCommand, and Sigma's windash modifier handles the separator forms
Decode the blob during enrichment so the alert carries the plaintext — an alert that says only 'encoded command observed' hands the analyst the same work the rule was supposed to do
Use payload length as a cheap second condition; a several-thousand-character blob is a different population from a forty-character one, and the split is usually visible in a day of your own data
Where script block logging is enabled, make 4104 the primary source and keep the command-line rule as coverage for the runtimes 4104 cannot see — and account for the multi-event split when you write the match

Declared by the author

Plain DPAPI secret handling — ConvertTo-SecureString -AsPlainText piped into ConvertFrom-SecureString with no -Key — which is the default and ubiquitous way to store a credential on a Windows host. Any such script that also logs or stamps the computer name or the domain in the same block matches, and this is the most common PowerShell idiom the rule will ever see.
Software inventory, licensing and device-enrolment scripts, which build a machine fingerprint by hashing the hardware UUID, the machine GUID or the computer name. Where such a script runs on a schedule it recurs on every host in the estate.
Configuration management and packaging frameworks that protect a secret with a machine-bound key. Desired State Configuration, installer wrappers and deployment scripts routinely call ConvertTo-SecureString or a key-derivation routine in the same script block that reads the computer name or the domain.
Backup, endpoint-protection and remote-management agents shipping PowerShell modules that checksum collected system information before uploading it, which reads as an identity value flowing into a hash.
Administrators writing an ad-hoc script that queries the hardware details and hashes the result to produce a per-host identifier for an asset register or a licence check.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1480.001, evaluated against their — events.

Share this rule

/u/siemphony/66d66665-7a21-47d5-8d0c-657971167355

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Script derives a cryptographic key from a machine identifier

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it