admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inGetAdGroup with PowerShell Script Block

Browse Source
This commit is contained in:
root
2021-09-10 16:50:32 +00:00
parent cb381af6ba
commit a656d3e187
1 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/getadgroup_with_powershell_script_block.yml
+11 -7
View File
@@ -7,15 +7,18 @@ type: Hunting
datamodel:
- Endpoint
description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain groups.
Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery.
search: '`powershell` EventCode=4104 (Message = "*Get-ADGroup*")
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
ComputerName User | `security_content_ctime(firstTime)` | `getadgroup_with_powershell_script_block_filter`'
to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet
is used to return a list of all domain groups. Red Teams and adversaries may leverage
this commandlet to enumerate domain groups for situational awareness and Active
Directory Discovery.
search: '`powershell` EventCode=4104 (Message = "*Get-ADGroup*") | stats count min(_time)
as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
| `getadgroup_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
known_false_positives: Administrators or power users may use this PowerShell commandlet
for troubleshooting.
references:
- https://attack.mitre.org/techniques/T1069/002/
- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps
@@ -47,4 +50,5 @@ tags:
- name: dest
type: Endpoint
role:
- Victim
- Victim
automated_detection_testing: passed