PowerShell ScriptBlock Enumeration of AD Group Membership and Users

Flags PowerShell script blocks querying AD group membership and user details for discovery of privileged directory information.

FreeUnreviewedSigmalowv1

powershell-scriptblock-enumeration-of-ad-group-membership-and-users-88f0884b

title: PowerShell ScriptBlock Enumeration of AD Group Membership and Users
id: 0de9477e-6d6d-45e3-9b53-526acab2fcf3
status: test
description: This rule matches PowerShell ScriptBlock content that calls get-ADPrincipalGroupMembership to enumerate Active Directory group membership. It also flags ScriptBlock code that includes get-aduser queries combined with parameters for filtering or permission-related results and the string DoesNotRequirePreAuth. Such discovery activity helps an attacker identify which users belong to privileged or permission-bearing groups by collecting information about directory users and their attributes. The detection relies on ScriptBlockText from PowerShell Script Block Logging and checks for specific command strings and parameter fragments within the executed script.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_ad_group_reco.yml
author: frack113, Huntrule Team
date: 2021-12-15
modified: 2022-12-25
tags:
  - attack.discovery
  - attack.t1069.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  test_2:
    ScriptBlockText|contains: get-ADPrincipalGroupMembership
  test_7:
    ScriptBlockText|contains|all:
      - get-aduser
      - "-f "
      - "-pr "
      - DoesNotRequirePreAuth
  condition: 1 of test_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 88f0884b-331d-403d-a3a1-b668cf035603
    type: derived

What it detects

This rule matches PowerShell ScriptBlock content that calls get-ADPrincipalGroupMembership to enumerate Active Directory group membership. It also flags ScriptBlock code that includes get-aduser queries combined with parameters for filtering or permission-related results and the string DoesNotRequirePreAuth. Such discovery activity helps an attacker identify which users belong to privileged or permission-bearing groups by collecting information about directory users and their attributes. The detection relies on ScriptBlockText from PowerShell Script Block Logging and checks for specific command strings and parameter fragments within the executed script.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.