Windows PowerShell Script: Suspicious LDAP Credential Handling for Remote Access

title: "Windows PowerShell Script: Suspicious LDAP Credential Handling for Remote Access"
id: 6fbdd60a-d36d-4d01-ac17-6aa66e0d2359
status: test
description: This rule flags Windows PowerShell script blocks that reference LDAP connection components and network credential objects. Such scripts may be used to interact with remote directory services and could support password guessing or other credential-access attempts when valid credentials are not known. The detection relies on Script Block Logging telemetry capturing the presence of specific .NET types and LDAP connection usage within the PowerShell code.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1110.001/T1110.001.md#atomic-test-2---brute-force-credentials-of-single-active-directory-domain-user-via-ldap-against-domain-controller-ntlm-or-kerberos
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_networkcredential.yml
author: frack113, Huntrule Team
date: 2021-12-27
tags:
  - attack.credential-access
  - attack.t1110.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - System.DirectoryServices.Protocols.LdapDirectoryIdentifier
      - System.Net.NetworkCredential
      - System.DirectoryServices.Protocols.LdapConnection
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 1883444f-084b-419b-ac62-e0d0c5b3693f
    type: derived