Windows PowerShell Execution of ADRecon.ps1 for Active Directory Reconnaissance

title: Windows PowerShell Execution of ADRecon.ps1 for Active Directory Reconnaissance
id: eff1ce84-f0cb-41e9-8124-34e3d115bb6a
status: test
description: This rule flags PowerShell script block content associated with ADRecon used for Active Directory reconnaissance. Such discovery activity can support subsequent lateral movement and privilege escalation by identifying domain controllers, GPOs, and exporting results to an Excel report. It relies on PowerShell Script Block Logging telemetry and matches specific script block strings, including functions for AD data retrieval and the default report filename ADRecon-Report.xlsx.
references:
  - https://github.com/sense-of-security/ADRecon/blob/11881a24e9c8b207f31b56846809ce1fb189bcc9/ADRecon.ps1
  - https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_adrecon_execution.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-07-16
modified: 2022-09-06
tags:
  - attack.discovery
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - Function Get-ADRExcelComOb
      - Get-ADRGPO
      - Get-ADRDomainController
      - ADRecon-Report.xlsx
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: bf72941a-cba0-41ea-b18c-9aca3925690d
    type: derived