PowerShell Get-ADComputer Cmdlet Used for Computer Discovery and File Export
Flags PowerShell Get-ADComputer wildcard enumeration followed by writing exported computer data to a file.
- Product
- windows
- Category
- ps_script
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-11-17
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script block content that runs the Get-ADComputer cmdlet with a wildcard filter for broad computer discovery, then selects and writes results to a file using commands such as Out-File, Set-Content, or Add-Content. Attackers may use this pattern to enumerate target systems from Active Directory and stage collected inventory for later access or operational use. It relies on Script Block Logging telemetry capturing the executed script text.
Reporting behind it
- blog.talosintelligence.comhttp://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
- cisa.govhttps://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_computer_discovery_get_adcomputer.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Get-ADComputer Cmdlet Used for Computer Discovery and File Export
id: 60d1e46c-4c8f-4244-bd15-11221da87086
related:
- id: 435e10e4-992a-4281-96f3-38b11106adde
type: similar
- id: db885529-903f-4c5d-9864-28fe199e6370
type: derived
status: test
description: This rule flags PowerShell script block content that runs the Get-ADComputer cmdlet with a wildcard filter for broad computer discovery, then selects and writes results to a file using commands such as Out-File, Set-Content, or Add-Content. Attackers may use this pattern to enumerate target systems from Active Directory and stage collected inventory for later access or operational use. It relies on Script Block Logging telemetry capturing the executed script text.
references:
- http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
- https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
- https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_computer_discovery_get_adcomputer.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-17
tags:
- attack.discovery
- attack.t1033
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains|all:
- "Get-ADComputer "
- " -Filter \\*"
ScriptBlockText|contains:
- " | Select "
- Out-File
- Set-Content
- Add-Content
condition: selection
falsepositives:
- Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often
level: medium
license: DRL-1.1