description: Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity ...
I'm seeing an issue on Windows 10 1703 where typing too quickly into a Read-Host -AsSecureString prompt will forcefully terminate the running script. For example: typing "asdf;lkjasdf;lkjasdf;lkjasd" ...