PowerShell Get-ADComputer Export of Active Directory Computer Data to File (Windows)
Detects PowerShell running Get-ADComputer (* filter) and exporting results to a file via output/content cmdlets.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-11-10
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell or pwsh executions that run the Get-ADComputer cmdlet with a wildcard filter and then export the results to a file or pipe them through common file/content output cmdlets (e.g., Out-File, Set-Content, Add-Content). Attackers can use directory discovery followed by data export to enumerate targets and collect host information for later actions. Telemetry relies on Windows process creation events that include the executable image and the full command line content.
Reporting behind it
- blog.talosintelligence.comhttp://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
- cisa.govhttps://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_computer_discovery_get_adcomputer.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Get-ADComputer Export of Active Directory Computer Data to File (Windows)
id: 5c256d38-4b04-43e7-80f8-12c6b0f71d10
related:
- id: db885529-903f-4c5d-9864-28fe199e6370
type: similar
- id: 435e10e4-992a-4281-96f3-38b11106adde
type: derived
status: test
description: This rule flags PowerShell or pwsh executions that run the Get-ADComputer cmdlet with a wildcard filter and then export the results to a file or pipe them through common file/content output cmdlets (e.g., Out-File, Set-Content, Add-Content). Attackers can use directory discovery followed by data export to enumerate targets and collect host information for later actions. Telemetry relies on Windows process creation events that include the executable image and the full command line content.
references:
- http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
- https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
- https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_computer_discovery_get_adcomputer.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-10
modified: 2022-11-17
tags:
- attack.discovery
- attack.t1033
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \powershell.exe
- \pwsh.exe
- OriginalFileName:
- PowerShell.EXE
- pwsh.dll
selection_cli:
CommandLine|contains|all:
- "Get-ADComputer "
- " -Filter \\*"
CommandLine|contains:
- " > "
- " | Select "
- Out-File
- Set-Content
- Add-Content
condition: all of selection_*
falsepositives:
- Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often
level: medium
license: DRL-1.1