Invocation Of Crypto-Classes From The "Cryptography" PowerShell Namespace

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•25

Detects the invocation of PowerShell commands that reference classes from the "System.Security.Cryptography" namespace. This namespace provides classes for on-the-fly encryption and decryption, which can be abused by adversaries for defense evasion, such as decrypting malicious payloads.