From 2eabac8fae2ebb326db10f8c9d1f5e020aa45619 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 10 Sep 2021 15:07:08 +0000 Subject: [PATCH] Added detection testing service results inGetDomainController with PowerShell Script Block --- ...controller_with_powershell_script_block.yml | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml index 6c01ed9ecd..4df9dd68c2 100644 --- a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml @@ -7,15 +7,18 @@ type: TTP datamodel: - Endpoint description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - to identify the execution of the `Get-DomainController` commandlet. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. - Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 (Message = "*Get-DomainController*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `getdomaincontroller_with_powershell_script_block_filter`' + to identify the execution of the `Get-DomainController` commandlet. `Get-DomainController` + is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. + Red Teams and adversaries alike may use PowerView to enumerate domain computers + for situational awareness and Active Directory Discovery. +search: '`powershell` EventCode=4104 (Message = "*Get-DomainController*") | stats + count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName + User | `security_content_ctime(firstTime)` | `getdomaincontroller_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting. +known_false_positives: Administrators or power users may use this PowerShell commandlet + for troubleshooting. references: - https://attack.mitre.org/techniques/T1018/ - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/ @@ -47,4 +50,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed