PowerShell Get-ADUser User Discovery and Data Export via File Output
Detects PowerShell Get-ADUser-based user enumeration combined with exporting results to files or output streams.
- Product
- windows
- Category
- ps_script
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-11-17
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script block activity that invokes the Get-ADUser cmdlet with a broad filter and then exports results to a file using operators such as redirection, Select with output piping, Out-File, Set-Content, or Add-Content. Attackers commonly use directory queries to enumerate targets and then store the output for later use, supporting discovery and subsequent actions. Detection relies on Script Block Logging telemetry capturing the PowerShell code text patterns matching Get-ADUser usage and file-write/output constructs.
Reporting behind it
- blog.talosintelligence.comhttp://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_user_discovery_get_aduser.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Get-ADUser User Discovery and Data Export via File Output
id: 3d3080fc-c63f-4609-9a4c-18a8234fe897
related:
- id: 1114e048-b69c-4f41-bc20-657245ae6e3f
type: similar
- id: c2993223-6da8-4b1a-88ee-668b8bf315e9
type: derived
status: test
description: This rule flags PowerShell script block activity that invokes the Get-ADUser cmdlet with a broad filter and then exports results to a file using operators such as redirection, Select with output piping, Out-File, Set-Content, or Add-Content. Attackers commonly use directory queries to enumerate targets and then store the output for later use, supporting discovery and subsequent actions. Detection relies on Script Block Logging telemetry capturing the PowerShell code text patterns matching Get-ADUser usage and file-write/output constructs.
references:
- http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
- https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_user_discovery_get_aduser.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-17
tags:
- attack.discovery
- attack.t1033
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains|all:
- "Get-ADUser "
- " -Filter \\*"
ScriptBlockText|contains:
- " > "
- " | Select "
- Out-File
- Set-Content
- Add-Content
condition: selection
falsepositives:
- Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often
level: medium
license: DRL-1.1