name: GetCurrent User with PowerShell
id: 7eb9c3d5-c98c-4088-acc5-8240bad15379
version: 1
date: '2021-09-13'
author: Mauricio Velazco, Splunk
type: Hunting
datamodel:
- Endpoint
description: This analytic looks for the execution of `powerhsell.exe` with command-line
  arguments that execute the `GetCurrent` method of the WindowsIdentity .NET class.
  This method returns an object that represents the current Windows user. Red Teams
  and adversaries may leverage this method to identify the logged user on a compromised
  endpoint for situational awareness and Active Directory Discovery.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
  (Processes.process=*System.Security.Principal.WindowsIdentity* OR Processes.process=*GetCurrent()*)
  by Processes.dest Processes.user Processes.parent_process Processes.process_name
  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getcurrent_user_with_powershell_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
- https://attack.mitre.org/techniques/T1033/
tags:
  analytic_story:
  - Active Directory Discovery
  confidence: 50
  context:
  - Source:Endpoint
  - Stage:Discovery
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log
  impact: 30
  kill_chain_phases:
  - Reconnaissance
  message: System user discovery on $dest$
  mitre_attack_id:
  - T1033
  observable:
  - name: dest
    type: Endpoint
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.dest
  - Processes.user
  - Processes.parent_process_name
  - Processes.parent_process
  - Processes.original_file_name
  - Processes.process_name
  - Processes.process
  - Processes.process_id
  - Processes.parent_process_path
  - Processes.process_path
  - Processes.parent_process_id
  risk_score: 15
  security_domain: endpoint
  asset_type: Endpoint