Windows PowerShell AD Computer Enumeration via Get-ADComputer

title: Windows PowerShell AD Computer Enumeration via Get-ADComputer
id: 4ba08087-421a-4bd6-b3c7-4e34d9366603
status: test
description: This rule identifies PowerShell script block activity that calls Get-ADComputer to enumerate Active Directory computers or retrieve computer properties. Enumeration is commonly used by attackers to map the environment before further access attempts. The detection relies on ScriptBlockText telemetry and matches the presence of Get-ADComputer along with common parameters such as -Filter, -LDAPFilter, and -Properties.
references:
  - https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md
  - https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1087.002/T1087.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_get_adcomputer.yml
author: frack113, Huntrule Team
date: 2022-03-17
modified: 2023-07-08
tags:
  - attack.discovery
  - attack.t1018
  - attack.t1087.002
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_cmdlet:
    ScriptBlockText|contains: "Get-AdComputer "
  selection_option:
    ScriptBlockText|contains:
      - "-Filter "
      - "-LDAPFilter "
      - "-Properties "
  condition: all of selection_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 36bed6b2-e9a0-4fff-beeb-413a92b86138
    type: derived