PowerShell Get-ADComputer Export of Active Directory Computer Data to File (Windows)

Detects PowerShell running Get-ADComputer (* filter) and exporting results to a file via output/content cmdlets.

FreeUnreviewedSigmamediumv1

powershell-get-adcomputer-export-of-active-directory-computer-data-to-file-windo-435e10e4

title: PowerShell Get-ADComputer Export of Active Directory Computer Data to File (Windows)
id: 5c256d38-4b04-43e7-80f8-12c6b0f71d10
related:
  - id: db885529-903f-4c5d-9864-28fe199e6370
    type: similar
  - id: 435e10e4-992a-4281-96f3-38b11106adde
    type: derived
status: test
description: This rule flags PowerShell or pwsh executions that run the Get-ADComputer cmdlet with a wildcard filter and then export the results to a file or pipe them through common file/content output cmdlets (e.g., Out-File, Set-Content, Add-Content). Attackers can use directory discovery followed by data export to enumerate targets and collect host information for later actions. Telemetry relies on Windows process creation events that include the executable image and the full command line content.
references:
  - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
  - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
  - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_computer_discovery_get_adcomputer.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-10
modified: 2022-11-17
tags:
  - attack.discovery
  - attack.t1033
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_cli:
    CommandLine|contains|all:
      - "Get-ADComputer "
      - " -Filter \\*"
    CommandLine|contains:
      - " > "
      - " | Select "
      - Out-File
      - Set-Content
      - Add-Content
  condition: all of selection_*
falsepositives:
  - Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell or pwsh executions that run the Get-ADComputer cmdlet with a wildcard filter and then export the results to a file or pipe them through common file/content output cmdlets (e.g., Out-File, Set-Content, Add-Content). Attackers can use directory discovery followed by data export to enumerate targets and collect host information for later actions. Telemetry relies on Windows process creation events that include the executable image and the full command line content.

Known false positives

Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.