Windows PowerShell Credential Guessing via LDAP using System.Net.NetworkCredential
Detects PowerShell scripts referencing LDAP connection and .NET network credential handling, potentially indicating remote credential access activity.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-12-27
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script block content that constructs LDAP connections and uses System.Net.NetworkCredential, which can be used to repeatedly try credential values against remote accounts. Credential guessing and brute-force attempts matter because they seek access by iterating authentication attempts without valid prior credentials. The detection relies on Script Block Logging telemetry to match specific .NET classes and LDAP connection patterns within executed PowerShell code.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1110.001/T1110.001.md#atomic-test-2---brute-force-credentials-of-single-active-directory-domain-user-via-ldap-against-domain-controller-ntlm-or-kerberos
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_networkcredential.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Credential Guessing via LDAP using System.Net.NetworkCredential
id: 6fbdd60a-d36d-4d01-ac17-6aa66e0d2359
status: test
description: This rule flags PowerShell script block content that constructs LDAP connections and uses System.Net.NetworkCredential, which can be used to repeatedly try credential values against remote accounts. Credential guessing and brute-force attempts matter because they seek access by iterating authentication attempts without valid prior credentials. The detection relies on Script Block Logging telemetry to match specific .NET classes and LDAP connection patterns within executed PowerShell code.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1110.001/T1110.001.md#atomic-test-2---brute-force-credentials-of-single-active-directory-domain-user-via-ldap-against-domain-controller-ntlm-or-kerberos
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_networkcredential.yml
author: frack113, Huntrule Team
date: 2021-12-27
tags:
- attack.credential-access
- attack.t1110.001
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains:
- System.DirectoryServices.Protocols.LdapDirectoryIdentifier
- System.Net.NetworkCredential
- System.DirectoryServices.Protocols.LdapConnection
condition: selection
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: 1883444f-084b-419b-ac62-e0d0c5b3693f
type: derived