Detect TLS Validation Bypass Via Power Shell
Query
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe","pwsh.exe")
| where ProcessCommandLine has_any ("ServerCertificateValidationCallback","TrustAllCertsPolicy","SkipCertificateCheck","CertificatePolicy")
| project Timestamp, DeviceName,DeviceId, AccountName, FileName, ProcessCommandLine , ReportIdAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1059.001 | Command and Scripting Interpreter: PowerShell |
Author: Sergio Albea (03/04/2026)
Detect TLS validation bypass via PowerShell
PowerShell disabling TLS validation before downloading the payload, it’s a small step, but a very useful one from a detection point of view. Just reading about a fake Boeing RFQ was enough to trigger a full attack chain — starting from a DOCX and moving through RTF, JavaScript, PowerShell and even a full Python runtime, ending with Cobalt Strike running in memory. Nothing particularly new in terms of techniques, but the way everything is chained together makes it effective and easy to miss. It relies on tools and formats we see daily. Being focus on catch the IoA Pattern, I created the KQL Detection below.
Explanation
This query is designed to detect suspicious PowerShell activity related to bypassing TLS (Transport Layer Security) validation, which can be a sign of malicious behavior. Here's a simple breakdown of what the query does:
-
Data Source: It looks at
DeviceProcessEvents, which contains records of processes that have been executed on devices. -
Time Frame: It filters the data to only include events from the last 7 days (
Timestamp > ago(7d)). -
Targeted Processes: It specifically focuses on processes where the file name is either
powershell.exeorpwsh.exe, which are common executables for running PowerShell scripts. -
Suspicious Commands: The query searches for specific terms in the command line arguments of these processes that are commonly associated with bypassing TLS certificate validation. These terms include:
ServerCertificateValidationCallbackTrustAllCertsPolicySkipCertificateCheckCertificatePolicy
-
Output: It projects (or selects) specific fields to display in the results, including:
Timestamp: When the process event occurred.DeviceName: The name of the device where the process was executed.DeviceId: The unique identifier of the device.AccountName: The user account under which the process was run.FileName: The name of the executable file.ProcessCommandLine: The full command line used to execute the process.ReportId: An identifier for the report or event.
Overall, this query helps security analysts identify potential indicators of attack (IoA) by flagging PowerShell processes that might be attempting to bypass security measures, which could be part of a larger attack chain.
