Sigma low test sigma

Active Directory Computers Enumeration With Get-AdComputer

Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.

View Source

Detection Logic

{
  "selection_cmdlet": {
    "ScriptBlockText
| contains": "Get-AdComputer "
  },
  "selection_option": {
    "ScriptBlockText
| contains": [
      "-Filter ",
      "-LDAPFilter ",
      "-Properties "
    ]
  },
  "condition": "all of selection_*"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...