admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'AD_Discovery_TR-789_7' of https://github.com/splunk/security_content into AD_Discovery_TR-789_7

Browse Source
This commit is contained in:
Detection Testing Service
2021-09-09 21:43:52 +00:00
parent a304fdd421 5875cf6123
commit 73c10ecc37
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/getdomaincomputer_with_powershell_script_block.yml
+9 -6
View File
@@ -7,11 +7,13 @@ type: TTP
datamodel:
- Endpoint
description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify the execution of the `Get-DomainComputer` commandlet. `GetDomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.
Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery.
search: '`powershell` EventCode=4104 (Message = "*Get-DomainComputer*")
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
ComputerName User | `security_content_ctime(firstTime)` | `getdomaincomputer_with_powershell_script_block_filter`'
to identify the execution of the `Get-DomainComputer` commandlet. `GetDomainComputer`
is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.
Red Teams and adversaries alike may use PowerView to enumerate domain computers
for situational awareness and Active Directory Discovery.
search: '`powershell` EventCode=4104 (Message = "*Get-DomainComputer*") | stats count
min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
User | `security_content_ctime(firstTime)` | `getdomaincomputer_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -47,4 +49,5 @@ tags:
- name: dest
type: Endpoint
role:
- Victim
- Victim
automated_detection_testing: passed