PowerShell Computer Discovery and Export Using Get-ADComputer

Flags PowerShell Get-ADComputer wildcard enumeration followed by writing exported computer data to a file.

FreeUnreviewedSigmamediumv1

powershell-computer-discovery-and-export-using-get-adcomputer-db885529

title: PowerShell Computer Discovery and Export Using Get-ADComputer
id: 60d1e46c-4c8f-4244-bd15-11221da87086
related:
  - id: 435e10e4-992a-4281-96f3-38b11106adde
    type: similar
  - id: db885529-903f-4c5d-9864-28fe199e6370
    type: derived
status: test
description: This rule identifies PowerShell script block activity that uses the Get-ADComputer cmdlet with a wildcard filter to enumerate computer objects. It also looks for evidence of exporting or writing the collected results to a file using output and file-writing cmdlets such as Select with Out-File, Set-Content, or Add-Content. This behavior matters because attackers often gather host inventories from Active Directory for targeting, staging, or post-compromise activity, and export it for later use. The detection relies on PowerShell Script Block Logging telemetry containing the relevant command text.
references:
  - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
  - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
  - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_computer_discovery_get_adcomputer.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-17
tags:
  - attack.discovery
  - attack.t1033
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - "Get-ADComputer "
      - " -Filter \\*"
    ScriptBlockText|contains:
      - " | Select "
      - Out-File
      - Set-Content
      - Add-Content
  condition: selection
falsepositives:
  - Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often
level: medium
license: DRL-1.1

What it detects

This rule identifies PowerShell script block activity that uses the Get-ADComputer cmdlet with a wildcard filter to enumerate computer objects. It also looks for evidence of exporting or writing the collected results to a file using output and file-writing cmdlets such as Select with Out-File, Set-Content, or Add-Content. This behavior matters because attackers often gather host inventories from Active Directory for targeting, staging, or post-compromise activity, and export it for later use. The detection relies on PowerShell Script Block Logging telemetry containing the relevant command text.

Known false positives

Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.