PowerShell DirectorySearcher Active Directory Enumeration via DirectoryServices

Flags PowerShell DirectorySearcher queries that load directory properties and enumerate results from Active Directory.

FreeUnreviewedSigmamediumv1

powershell-directorysearcher-active-directory-enumeration-via-directoryservices-1f6399cf

title: PowerShell DirectorySearcher Active Directory Enumeration via DirectoryServices
id: 9db693a2-8bc9-4cb9-b3a4-1e7dc31fff86
status: test
description: This rule identifies PowerShell script block activity that creates a System.DirectoryServices.DirectorySearcher, loads specific directory properties, and runs findall() while using .PropertiesToLoad and Properties.name. Such behavior is commonly used to enumerate domain-joined computers by querying Active Directory, which can support subsequent discovery and targeting. The detection relies on Script Block Logging telemetry capturing the relevant PowerShell code patterns.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md#atomic-test-15---enumerate-domain-computers-within-active-directory-using-directorysearcher
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_directorysearcher.yml
author: frack113, Huntrule Team
date: 2022-02-12
tags:
  - attack.discovery
  - attack.t1018
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - "New-Object "
      - System.DirectoryServices.DirectorySearcher
      - .PropertiesToLoad.Add
      - .findall()
      - Properties.name
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 1f6399cf-2c80-4924-ace1-6fcff3393480
    type: derived

What it detects

This rule identifies PowerShell script block activity that creates a System.DirectoryServices.DirectorySearcher, loads specific directory properties, and runs findall() while using .PropertiesToLoad and Properties.name. Such behavior is commonly used to enumerate domain-joined computers by querying Active Directory, which can support subsequent discovery and targeting. The detection relies on Script Block Logging telemetry capturing the relevant PowerShell code patterns.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.