Elastic low stable kql

PowerShell Script with Password Policy Discovery Capabilities

Identifies PowerShell script block content that queries Active Directory password policy settings using AD cmdlets, GPP password helpers, or directory searcher attributes. Attackers collect password policy details to tune credential attacks and target weak configurations.

View Source

Detection Logic

event.category: "process" and host.os.type:windows and
(
  powershell.file.script_block_text: (
    "Get-ADDefaultDomainPasswordPolicy" or
    "Get-ADFineGrainedPasswordPolicy" or
    "Get-ADUserResultantPasswordPolicy" or
    "Get-DomainPolicy" or
    "Get-GPPPassword" or
    "Get-PassPol"
  )
  or
  powershell.file.script_block_text: (
    ("defaultNamingContext" or "ActiveDirectory.DirectoryContext" or "ActiveDirectory.DirectorySearcher") and
    (
      (
        ".MinLengthPassword" or
        ".MinPasswordAge" or
        ".MaxPasswordAge"
      ) or
      (
        "minPwdAge" or
        "maxPwdAge" or
        "minPwdLength"
      ) or
      (
        "msDS-PasswordSettings"
      )
    )
  )
) and

not powershell.file.script_block_text : ("sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators") and
not powershell.file.script_block_text : ("43c15630-959c-49e4-a977-758c5cc93408" and "CmdletsToExport" and "ActiveDirectory.Types.ps1xml") and
not file.directory: "C:\Program Files\LogicMonitor\Agent\tmp" and
not user.id : "S-1-5-18"

Field Validations

Loading…

Comments (0)

Loading comments...