From fc5afe8ab9ff035fbd2b8b5eefb5b4a7b11b1edf Mon Sep 17 00:00:00 2001 From: root Date: Fri, 10 Sep 2021 15:24:21 +0000 Subject: [PATCH] Added detection testing service results inGetWmiObject Ds Computer with PowerShell Script Block --- ..._computer_with_powershell_script_block.yml | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml index c018db1d9c..4375238d98 100644 --- a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml @@ -7,18 +7,22 @@ type: TTP datamodel: - Endpoint description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - to identify the execution of the `Get-WmiObject` commandlet. The `DS_Computer` class parameter leverages WMI to query for all domain computers. - Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace root\\directory\\ldap"* AND Message=*"class ds_computer"*) - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_computer_with_powershell_script_block_filter`' + to identify the execution of the `Get-WmiObject` commandlet. The `DS_Computer` class + parameter leverages WMI to query for all domain computers. Red Teams and adversaries + may leverage this commandlet to enumerate domain computers for situational awareness + and Active Directory Discovery. +search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace + root\\directory\\ldap"* AND Message=*"class ds_computer"*) | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `getwmiobject_ds_computer_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting. +known_false_positives: Administrators or power users may use this PowerShell commandlet + for troubleshooting. references: - https://attack.mitre.org/techniques/T1018/ -- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 +- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 tags: analytic_story: - Active Directory Discovery @@ -47,4 +51,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed