Windows PowerShell: Get-ADUser Enumeration via UserAccountControl DONT_REQ_PREAUTH

Flags Get-ADUser PowerShell scripts enumerating accounts by UserAccountControl DONT_REQ_PREAUTH (4194304).

FreeUnreviewedSigmamediumv1

windows-powershell-get-aduser-enumeration-via-useraccountcontrol-dont-req-preaut-96c982fe

title: "Windows PowerShell: Get-ADUser Enumeration via UserAccountControl DONT_REQ_PREAUTH"
id: f0f9d2ba-0030-4eb4-b09e-48bd1a58525b
status: test
description: This rule identifies PowerShell activity that uses Get-ADUser with an -Filter expression targeting the UserAccountControl DONT_REQ_PREAUTH flag (4194304). Attackers can use this targeted enumeration to find accounts with specific authentication behavior, which may enable follow-on credential access techniques. Telemetry relies on PowerShell Script Block logging that captures ScriptBlockText content containing the relevant Get-ADUser and filter components.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md#atomic-test-11---get-aduser-enumeration-using-useraccountcontrol-flags-as-rep-roasting
  - https://shellgeek.com/useraccountcontrol-flags-to-manipulate-properties/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_as_rep_roasting.yml
author: frack113, Huntrule Team
date: 2022-03-17
tags:
  - attack.discovery
  - attack.t1033
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - Get-ADUser
      - -Filter
      - useraccountcontrol
      - -band
      - "4194304"
  condition: selection
falsepositives:
  - Legitimate PowerShell scripts
level: medium
license: DRL-1.1
related:
  - id: 96c982fe-3d08-4df4-bed2-eb14e02f21c8
    type: derived

What it detects

This rule identifies PowerShell activity that uses Get-ADUser with an -Filter expression targeting the UserAccountControl DONT_REQ_PREAUTH flag (4194304). Attackers can use this targeted enumeration to find accounts with specific authentication behavior, which may enable follow-on credential access techniques. Telemetry relies on PowerShell Script Block logging that captures ScriptBlockText content containing the relevant Get-ADUser and filter components.

Known false positives

Legitimate PowerShell scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.