mdecrevoisier medium experimental sigma

Active Directory Forest PowerShell class called from a non administrative host

Detects scenarios where an attacker attempts to call the Active Directory Forest PowerShell class on a non administrative host in order to enumerate trusts, forests, domains, sites and subnet information.

View Source

Detection Logic

{
  "selection_powershell_native": {
    "EventID": 800,
    "EventData
| contains": "System.DirectoryServices.ActiveDirectory"
  },
  "selection_powershell_modern": {
    "EventID": 4103,
    "Payload
| contains": "System.DirectoryServices.ActiveDirectory"
  },
  "selection_powershell_block": {
    "EventID": 4104,
    "ScriptBlockText
| contains": "System.DirectoryServices.ActiveDirectory"
  },
  "filter": [
    {
      "Computer": "%admin_workstation%"
    },
    {
      "Computer": "%domain_controllers%"
    }
  ],
  "condition": "1 of selection* and not filter"
}

False Positives

⚠ Adminitrative host, jump host, domain controllers, Exchange servers, application interacting with Active Directory modules

Field Validations

Loading…

Comments (0)

Loading comments...