Hayabusa low test sigma

Active Directory Computers Enumeration With Get-AdComputer

Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.

View Source

Detection Logic

{
  "ps_script": {
    "EventID": 4104,
    "Channel": [
      "Microsoft-Windows-PowerShell/Operational",
      "PowerShellCore/Operational"
    ]
  },
  "selection_cmdlet": {
    "ScriptBlockText
| contains": "Get-AdComputer "
  },
  "selection_option": {
    "ScriptBlockText
| contains": [
      "-Filter ",
      "-LDAPFilter ",
      "-Properties "
    ]
  },
  "condition": "ps_script and (all of selection_*)"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...