mdecrevoisier medium experimental sigma

Active Directory PowerShell module called from a non administrative host

Detects scenarios where an attacker attempts to load the Active Directory PowerShell module on a non administrative host in order to enumerate users, groups, ... Also note that no user information is reported by this event ID and that some correation would be required.

View Source

Detection Logic

{
  "selection": {
    "EventID": 600,
    "ProviderName": "ActiveDirectory"
  },
  "filter": [
    {
      "Computer": "%admin_workstation%"
    },
    {
      "Computer": "%domain_controllers%"
    }
  ],
  "condition": "selection and not filter"
}

False Positives

⚠ Adminitrative host, jump host, domain controllers, Exchange servers, application interacting with Active Directory modules

Field Validations

Loading…

Comments (0)

Loading comments...