name: Get-DomainTrust with PowerShell Script Block
id: 89275e7e-0548-11ec-bf75-acde48001122
version: 2
date: '2022-05-02'
author: Michael Haag, Splunk
type: TTP
datamodel: []
description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
  to identify suspicious PowerShell execution. Script Block Logging captures the command
  sent to PowerShell, the full command to be executed. Upon enabling, logs will output
  to Windows event logs. Dependent upon volume, enable on critical endpoints or all.
  \

  This analytic identifies Get-DomainTrust from PowerView in order to gather domain
  trust information. \

  During triage, review parallel processes using an EDR product or 4688 events. It
  will be important to understand the timeline of events around this activity. Review
  the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 ScriptBlockText = "*get-domaintrust*" | stats count min(_time)
  as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
  PowerShell Script Block Logging on some or all endpoints. Additional setup here
  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: It is possible certain system management frameworks utilize
  this command to gather trust information.
references:
- https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
tags:
  analytic_story:
  - Active Directory Discovery
  confidence: 40
  context:
  - Source:Endpoint
  - Stage:Discovery
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaintrust.log
  impact: 30
  kill_chain_phases:
  - Reconnaissance
  message: Suspicious PowerShell Get-DomainTrust was identified on endpoint $Computer$
    by user $UserID$.
  mitre_attack_id:
  - T1482
  observable:
  - name: UserID
    type: User
    role:
    - Victim
  - name: Computer
    type: Hostname
    role:
    - Victim
  - name: parent_process_name
    type: Process
    role:
    - Parent Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - ScriptBlockText
  - Opcode
  - Computer
  - UserID
  - EventCode
  risk_score: 12
  security_domain: endpoint
  asset_type: Endpoint