mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
research bot
97 lines
3.5 KiB
Markdown
97 lines
3.5 KiB
Markdown
---
|
|
title: "GetLocalUser with PowerShell"
|
|
excerpt: "Account Discovery, Local Account"
|
|
categories:
|
|
- Endpoint
|
|
last_modified_at: 2021-08-23
|
|
toc: true
|
|
toc_label: ""
|
|
tags:
|
|
- Account Discovery
|
|
- Discovery
|
|
- Local Account
|
|
- Discovery
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
- Endpoint
|
|
---
|
|
|
|
|
|
|
|
[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
|
|
|
|
#### Description
|
|
|
|
This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for local users. The `Get-LocalUser` commandlet is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
|
|
|
|
- **Type**: Hunting
|
|
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
|
|
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
|
|
- **Last Updated**: 2021-08-23
|
|
- **Author**: Mauricio Velazco, Splunk
|
|
- **ID**: 85fae8fa-0427-11ec-8b78-acde48001122
|
|
|
|
|
|
#### [ATT&CK](https://attack.mitre.org/)
|
|
|
|
| ID | Technique | Tactic |
|
|
| ----------- | ----------- |--------------- |
|
|
| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
|
|
|
|
| [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery |
|
|
|
|
#### Search
|
|
|
|
```
|
|
|
|
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-LocalUser*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
|
|
| `drop_dm_object_name(Processes)`
|
|
| `security_content_ctime(firstTime)`
|
|
| `security_content_ctime(lastTime)`
|
|
| `getlocaluser_with_powershell_filter`
|
|
```
|
|
|
|
#### Associated Analytic Story
|
|
* [Active Directory Discovery](/stories/active_directory_discovery)
|
|
|
|
|
|
#### How To Implement
|
|
To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
|
|
|
|
#### Required field
|
|
* _time
|
|
|
|
|
|
#### Kill Chain Phase
|
|
* Reconnaissance
|
|
|
|
|
|
#### Known False Positives
|
|
Administrators or power users may use this PowerShell commandlet for troubleshooting.
|
|
|
|
|
|
#### RBA
|
|
|
|
| Risk Score | Impact | Confidence | Message |
|
|
| ----------- | ----------- |--------------|--------------|
|
|
| 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ |
|
|
|
|
|
|
|
|
|
|
#### Reference
|
|
|
|
* [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/)
|
|
|
|
|
|
|
|
#### Test Dataset
|
|
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
|
|
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
|
|
|
|
* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log)
|
|
|
|
|
|
|
|
[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getlocaluser_with_powershell.yml) \| *version*: **1** |