huntrule

Windows PowerShell AD Group Enumeration via Get-ADGroup Cmdlet

Flags PowerShell script blocks that call Get-ADGroup with -Filter to enumerate Active Directory groups.

FreeUnreviewedSigmalowv1
title: Windows PowerShell AD Group Enumeration via Get-ADGroup Cmdlet
id: 9e36ae21-6108-4132-8f74-505a44558d2b
status: test
description: This rule identifies PowerShell activity that uses the Get-ADGroup cmdlet with a -Filter argument, indicating enumeration of Active Directory groups. Attackers may use this to discover group membership targets and inform subsequent privilege discovery or access attempts. It relies on Script Block Logging telemetry to capture the executed PowerShell script text.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_get_adgroup.yml
author: frack113, Huntrule Team
date: 2022-03-17
modified: 2022-11-17
tags:
  - attack.discovery
  - attack.t1069.002
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - "Get-AdGroup "
      - -Filter
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 8c3a6607-b7dc-4f0d-a646-ef38c00b76ee
    type: derived

What it detects

This rule identifies PowerShell activity that uses the Get-ADGroup cmdlet with a -Filter argument, indicating enumeration of Active Directory groups. Attackers may use this to discover group membership targets and inform subsequent privilege discovery or access attempts. It relies on Script Block Logging telemetry to capture the executed PowerShell script text.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.