Windows PowerShell: Suspicious Get-ADReplAccount enumeration with all and server parameters

Alerts on PowerShell execution of Get-ADReplAccount with -All and -Server parameters for AD replication account enumeration.

FreeUnreviewedSigmamediumv1

windows-powershell-suspicious-get-adreplaccount-enumeration-with-all-and-server--060c3ef1

title: "Windows PowerShell: Suspicious Get-ADReplAccount enumeration with all and server parameters"
id: 1b621876-90fb-4027-8d8d-af942adce4fb
status: test
description: This rule flags PowerShell script block activity containing the DSInternals/AD replication account enumeration command Get-ADReplAccount along with both the -All and -Server parameters. Attackers may use this to identify accounts related to Active Directory replication, supporting credential access and subsequent exploitation. The detection relies on PowerShell Script Block Logging telemetry to match specific command text patterns in executed scripts.
references:
  - https://www.powershellgallery.com/packages/DSInternals
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.006/T1003.006.md#atomic-test-2---run-dsinternals-get-adreplaccount
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_get_adreplaccount.yml
author: frack113, Huntrule Team
date: 2022-02-06
tags:
  - attack.credential-access
  - attack.t1003.006
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - Get-ADReplAccount
      - "-All "
      - "-Server "
  condition: selection
falsepositives:
  - Legitimate PowerShell scripts
level: medium
license: DRL-1.1
related:
  - id: 060c3ef1-fd0a-4091-bf46-e7d625f60b73
    type: derived

What it detects

This rule flags PowerShell script block activity containing the DSInternals/AD replication account enumeration command Get-ADReplAccount along with both the -All and -Server parameters. Attackers may use this to identify accounts related to Active Directory replication, supporting credential access and subsequent exploitation. The detection relies on PowerShell Script Block Logging telemetry to match specific command text patterns in executed scripts.

Known false positives

Legitimate PowerShell scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.