PowerShell User Discovery and Export via Get-ADUser Cmdlet

Detects PowerShell Get-ADUser-based user enumeration combined with exporting results to files or output streams.

FreeUnreviewedSigmamediumv1

powershell-user-discovery-and-export-via-get-aduser-cmdlet-c2993223

title: PowerShell User Discovery and Export via Get-ADUser Cmdlet
id: 3d3080fc-c63f-4609-9a4c-18a8234fe897
related:
  - id: 1114e048-b69c-4f41-bc20-657245ae6e3f
    type: similar
  - id: c2993223-6da8-4b1a-88ee-668b8bf315e9
    type: derived
status: test
description: This rule flags PowerShell script block activity where Get-ADUser is used with a broad LDAP filter and the results are written to disk or piped into output-related cmdlets. Attackers often use this to enumerate directory users and export data for later targeting or post-compromise activity. The detection relies on Script Block Logging telemetry to match the specific command patterns and output operators used in the script.
references:
  - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
  - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_user_discovery_get_aduser.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-17
tags:
  - attack.discovery
  - attack.t1033
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - "Get-ADUser "
      - " -Filter \\*"
    ScriptBlockText|contains:
      - " > "
      - " | Select "
      - Out-File
      - Set-Content
      - Add-Content
  condition: selection
falsepositives:
  - Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell script block activity where Get-ADUser is used with a broad LDAP filter and the results are written to disk or piped into output-related cmdlets. Attackers often use this to enumerate directory users and export data for later targeting or post-compromise activity. The detection relies on Script Block Logging telemetry to match the specific command patterns and output operators used in the script.

Known false positives

Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.