name: PowerShell Domain Enumeration
id: e1866ce2-ca22-11eb-8e44-acde48001122
version: 10
date: '2025-07-28'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the execution of PowerShell commands
  used for domain enumeration, such as `get-netdomaintrust` and 
  `get-adgroupmember`. It leverages PowerShell Script Block Logging 
  (EventCode=4104) to capture and analyze the full command sent to PowerShell. 
  This activity is significant as it often indicates reconnaissance efforts by 
  an attacker to map out the domain structure and identify key users and groups.
  If confirmed malicious, this behavior could lead to further targeted attacks, 
  privilege escalation, and unauthorized access to sensitive information within 
  the domain.
data_source:
- Powershell Script Block Logging 4104
search: '`powershell` EventCode=4104 ScriptBlockText IN (*get-netdomaintrust*, *get-netforesttrust*,
  *get-addomain*, *get-adgroupmember*, *get-domainuser*) | fillnull | stats count
  min(_time) as firstTime max(_time) as lastTime by dest signature signature_id user_id
  vendor_product EventID Guid Opcode Name Path ProcessID ScriptBlockId ScriptBlockText
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_domain_enumeration_filter`'
how_to_implement: To successfully implement this analytic, you will need to 
  enable PowerShell Script Block Logging on some or all endpoints. Additional 
  setup here 
  https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: It is possible there will be false positives, filter as 
  needed.
references:
- https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
drilldown_searches:
- name: View the detection results for - "$dest$" and "$user_id$"
  search: '%original_detection_search% | search  dest = "$dest$" user_id = "$user_id$"'
  earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$",
    "$user_id$") starthoursago=168  | stats count min(_time) as firstTime max(_time)
    as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk
    Message" values(analyticstories) as "Analytic Stories" values(annotations._all)
    as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics"
    by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
  earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
rba:
  message: A suspicious powershell script contains domain enumeration command in
    $ScriptBlockText$ in host $dest$
  risk_objects:
  - field: dest
    type: system
    score: 42
  - field: user_id
    type: user
    score: 42
  threat_objects: []
tags:
  analytic_story:
  - Hermetic Wiper
  - Malicious PowerShell
  - CISA AA23-347A
  - Data Destruction
  - Interlock Ransomware
  asset_type: Endpoint
  mitre_attack_id:
  - T1059.001
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: 
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration.log
    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
    sourcetype: XmlWinEventLog