Suspicious SSL Connection

Title: Suspicious SSL Connection
Status: test
Description:Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1573/T1573.md#atomic-test-1---openssl-c2
  -https://medium.com/walmartglobaltech/openssl-server-reverse-shell-from-windows-client-aee2dbfa0926
Author: frack113
Date: 2022-01-23
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.t1573'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains|all:
      -'System.Net.Security.SslStream'
      -'Net.Security.RemoteCertificateValidationCallback'
      -'.AuthenticateAsClient'

  condition:selection
Falsepositives:
  -Legitimate administrative script
Level: low