Windows PowerShell ScriptBlock alerts for DSInternals module cmdlet usage

title: Windows PowerShell ScriptBlock alerts for DSInternals module cmdlet usage
id: fbfff1ca-06bd-4548-ad91-29b26f8d1831
related:
  - id: 43d91656-a9b2-4541-b7e2-6a9bd3a13f4e
    type: similar
  - id: 846c7a87-8e14-4569-9d49-ecfd4276a01c
    type: derived
status: test
description: This rule flags PowerShell script block content that contains DSInternals module cmdlet and function names related to Active Directory and Azure AD administration, auditing, and key/password handling. Attackers may use DSInternals to query or transform directory secrets and keys (for example, DPAPI-related blobs, AD/NGC key material, and password or hash conversion), which can support credential access or persistence. It relies on Script Block Logging telemetry that captures the executed PowerShell script text.
references:
  - https://github.com/MichaelGrafnetter/DSInternals/blob/39ee8a69bbdc1cfd12c9afdd7513b4788c4895d4/Src/DSInternals.PowerShell/DSInternals.psd1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_dsinternals_cmdlets.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-06-26
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - Add-ADDBSidHistory
      - Add-ADNgcKey
      - Add-ADReplNgcKey
      - ConvertFrom-ADManagedPasswordBlob
      - ConvertFrom-GPPrefPassword
      - ConvertFrom-ManagedPasswordBlob
      - ConvertFrom-UnattendXmlPassword
      - ConvertFrom-UnicodePassword
      - ConvertTo-AADHash
      - ConvertTo-GPPrefPassword
      - ConvertTo-KerberosKey
      - ConvertTo-LMHash
      - ConvertTo-MsoPasswordHash
      - ConvertTo-NTHash
      - ConvertTo-OrgIdHash
      - ConvertTo-UnicodePassword
      - Disable-ADDBAccount
      - Enable-ADDBAccount
      - Get-ADDBAccount
      - Get-ADDBBackupKey
      - Get-ADDBDomainController
      - Get-ADDBGroupManagedServiceAccount
      - Get-ADDBKdsRootKey
      - Get-ADDBSchemaAttribute
      - Get-ADDBServiceAccount
      - Get-ADDefaultPasswordPolicy
      - Get-ADKeyCredential
      - Get-ADPasswordPolicy
      - Get-ADReplAccount
      - Get-ADReplBackupKey
      - Get-ADReplicationAccount
      - Get-ADSIAccount
      - Get-AzureADUserEx
      - Get-BootKey
      - Get-KeyCredential
      - Get-LsaBackupKey
      - Get-LsaPolicy
      - Get-SamPasswordPolicy
      - Get-SysKey
      - Get-SystemKey
      - New-ADDBRestoreFromMediaScript
      - New-ADKeyCredential
      - New-ADNgcKey
      - New-NTHashSet
      - Remove-ADDBObject
      - Save-DPAPIBlob
      - Set-ADAccountPasswordHash
      - Set-ADDBAccountPassword
      - Set-ADDBBootKey
      - Set-ADDBDomainController
      - Set-ADDBPrimaryGroup
      - Set-ADDBSysKey
      - Set-AzureADUserEx
      - Set-LsaPolicy
      - Set-SamAccountPasswordHash
      - Set-WinUserPasswordHash
      - Test-ADDBPasswordQuality
      - Test-ADPasswordQuality
      - Test-ADReplPasswordQuality
      - Test-PasswordQuality
      - Unlock-ADDBAccount
      - Write-ADNgcKey
      - Write-ADReplNgcKey
  condition: selection
falsepositives:
  - Legitimate usage of DSInternals for administration or audit purpose.
level: high
license: DRL-1.1