name: PowerShell Domain Enumeration
id: e1866ce2-ca22-11eb-8e44-acde48001122
version: 2
date: '2022-02-25'
author: Michael Haag, Splunk
type: TTP
datamodel: []
description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
  to identify suspicious PowerShell execution. Script Block Logging captures the command
  sent to PowerShell, the full command to be executed. Upon enabling, logs will output
  to Windows event logs. Dependent upon volume, enable on critical endpoints or all.
  \

  This analytic identifies specific PowerShell modules typically used to enumerate
  an organizations domain or users. \

  During triage, review parallel processes using an EDR product or 4688 events. It
  will be important to understand the timeline of events around this activity. Review
  the entire logged PowerShell script block.'
search: '`powershell` EventCode=4104 ScriptBlockText IN (*get-netdomaintrust*, *get-netforesttrust*,
  *get-addomain*, *get-adgroupmember*, *get-domainuser*) | stats count min(_time)
  as firstTime max(_time) as lastTime by Computer EventCode ScriptBlockText | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `powershell_domain_enumeration_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
  PowerShell Script Block Logging on some or all endpoints. Additional setup here
  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: It is possible there will be false positives, filter as needed.
references:
- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
- https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
- https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
tags:
  analytic_story:
  - Hermetic Wiper 
  - Malicious PowerShell
  confidence: 70
  context:
  - Source:Endpoint
  - Stage:Discovery
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration.log
  impact: 60
  kill_chain_phases:
  - Reconnaissance
  message: A suspicious powershell script contains domain enumeration command in $ScriptBlockText$
    with EventCode $EventCode$ in host $Computer$
  mitre_attack_id:
  - T1059
  - T1059.001
  observable:
  - name: Computer
    type: Hostname
    role:
    - Victim
  - name: UserID
    type: User
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - ScriptBlockText
  - Opcode
  - Computer
  - UserID
  - EventCode
  risk_score: 42
  security_domain: endpoint
  asset_type: Endpoint