admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inElevated Group Discovery with PowerView

Browse Source
This commit is contained in:
root
2021-09-10 16:00:25 +00:00
parent 20ab50e311
commit cb381af6ba
1 changed files with 14 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/elevated_group_discovery_with_powerview.yml
+14 -9
View File
@@ -7,13 +7,17 @@ type: Hunting
datamodel:
- Endpoint
description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.
As the name suggests, `Get-DomainGroupMember` is used to list the members of an specific domain group.
Red Teams and adversaries alike use PowerView to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users.
search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroupMember*")
AND Message IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*" , "*Server Operators*", "*Protected Users*", "*Dns Admins*")
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
ComputerName User | `security_content_ctime(firstTime)` | `elevated_group_discovery_with_powerview_filter`'
to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember`
is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.
As the name suggests, `Get-DomainGroupMember` is used to list the members of an
specific domain group. Red Teams and adversaries alike use PowerView to enumerate
elevated domain groups for situational awareness and Active Directory Discovery
to identify high privileged users.
search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroupMember*") AND Message
IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*"
, "*Server Operators*", "*Protected Users*", "*Dns Admins*") | stats count min(_time)
as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
| `elevated_group_discovery_with_powerview_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -22,7 +26,7 @@ references:
- https://attack.mitre.org/techniques/T1069/002/
- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroupMember/
- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory
- https://attack.mitre.org/techniques/T1069/002/
- https://attack.mitre.org/techniques/T1069/002/
tags:
analytic_story:
- Active Directory Discovery
@@ -51,4 +55,5 @@ tags:
- name: dest
type: Endpoint
role:
- Victim
- Victim
automated_detection_testing: passed