PowerShell AD enumeration via PoshModule: Get-ADPrincipalGroupMembership and Get-ADUser -pr -f

Flags PowerShell module usage of Get-ADPrincipalGroupMembership and Get-ADUser with -pr -f patterns indicative of AD discovery.

FreeUnreviewedSigmalowv1

powershell-ad-enumeration-via-poshmodule-get-adprincipalgroupmembership-and-get--815bfc17

title: "PowerShell AD enumeration via PoshModule: Get-ADPrincipalGroupMembership and Get-ADUser -pr -f"
id: c4be21c1-b625-4ed1-a6de-39e3c1061e16
status: test
description: This rule identifies PowerShell activity associated with enumerating Active Directory group membership and AD users using get-ADPrincipalGroupMembership and get-aduser. Such discovery helps an attacker map domain groups and determine which users belong to permission-related groups. It relies on telemetry fields capturing PowerShell module payload text and context information that include these specific cmdlets and parameter patterns.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_susp_ad_group_reco.yml
author: frack113, Huntrule Team
date: 2021-12-15
modified: 2023-01-20
tags:
  - attack.discovery
  - attack.t1069.001
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection_ad_principal:
    - Payload|contains: get-ADPrincipalGroupMembership
    - ContextInfo|contains: get-ADPrincipalGroupMembership
  selection_get_aduser:
    - Payload|contains|all:
        - get-aduser
        - "-f "
        - "-pr "
        - DoesNotRequirePreAuth
    - ContextInfo|contains|all:
        - get-aduser
        - "-f "
        - "-pr "
        - DoesNotRequirePreAuth
  condition: 1 of selection_*
falsepositives:
  - Administrator script
level: low
license: DRL-1.1
related:
  - id: 815bfc17-7fc6-4908-a55e-2f37b98cedb4
    type: derived

What it detects

This rule identifies PowerShell activity associated with enumerating Active Directory group membership and AD users using get-ADPrincipalGroupMembership and get-aduser. Such discovery helps an attacker map domain groups and determine which users belong to permission-related groups. It relies on telemetry fields capturing PowerShell module payload text and context information that include these specific cmdlets and parameter patterns.

Known false positives

Administrator script

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.