PowerShell AD Password Policy Discovery via Get-AdDefaultDomainPasswordPolicy

Alerts when PowerShell calls Get-AdDefaultDomainPasswordPolicy to enumerate an AD domain’s default password policy.

FreeUnreviewedSigmalowv1

powershell-ad-password-policy-discovery-via-get-addefaultdomainpasswordpolicy-bbb9495b

title: PowerShell AD Password Policy Discovery via Get-AdDefaultDomainPasswordPolicy
id: 9190c770-1ebc-48f3-9085-401e9ef48d26
status: test
description: This rule flags PowerShell script block activity that calls Get-AdDefaultDomainPasswordPolicy to retrieve an Active Directory domain’s default password policy. Attackers may use this information to understand password requirements before attempting credential attacks. The detection relies on Script Block logging capturing the presence of the Get-AdDefaultDomainPasswordPolicy command in PowerShell execution telemetry.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md#atomic-test-9---enumerate-active-directory-password-policy-with-get-addefaultdomainpasswordpolicy
  - https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2022-ps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_get_addefaultdomainpasswordpolicy.yml
author: frack113, Huntrule Team
date: 2022-03-17
tags:
  - attack.discovery
  - attack.t1201
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: Get-AdDefaultDomainPasswordPolicy
  condition: selection
falsepositives:
  - Legitimate PowerShell scripts
level: low
license: DRL-1.1
related:
  - id: bbb9495b-58fc-4016-b9df-9a3a1b67ca82
    type: derived

What it detects

This rule flags PowerShell script block activity that calls Get-AdDefaultDomainPasswordPolicy to retrieve an Active Directory domain’s default password policy. Attackers may use this information to understand password requirements before attempting credential attacks. The detection relies on Script Block logging capturing the presence of the Get-AdDefaultDomainPasswordPolicy command in PowerShell execution telemetry.

Known false positives

Legitimate PowerShell scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.