Windows PowerShell: Remove-ADGroupMember Removing Account from Domain Admin Group

title: "Windows PowerShell: Remove-ADGroupMember Removing Account from Domain Admin Group"
id: d54c485b-4b83-4cab-9808-699b7b0cfadb
status: test
description: This rule flags PowerShell script content that calls Remove-ADGroupMember with parameters indicating an account is being removed from a specified group and with members specified in the same command. Removing accounts from Domain Admins can disrupt privileged access and potentially interrupt administrative operations. The detection relies on Script Block Logging telemetry capturing the full PowerShell command text, matching for the Remove-ADGroupMember invocation along with identity and members parameters.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1531/T1531.md#atomic-test-3---remove-account-from-domain-admin-group
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_remove_adgroupmember.yml
author: frack113, Huntrule Team
date: 2021-12-26
tags:
  - attack.impact
  - attack.t1531
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - Remove-ADGroupMember
      - "-Identity "
      - "-Members "
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 48a45d45-8112-416b-8a67-46e03a4b2107
    type: derived