splunk-security_content/detections/endpoint/get_aduser_with_powershell_script_block.yml

name: Get ADUser with PowerShell Script Block
id: 21432e40-04f4-11ec-b7e6-acde48001122
version: 1
date: '2021-08-24'
author: Teoderick Contreras, Splunk
type: Hunting
datamodel:
- Endpoint
description: This search is to detect a powershell command get-aduser function to
  do user enumeration to the active directory. This command can be a normal query
  of a network admin but since the output of this is not so much structure and cannot
  give a concrete or specific information that admin may look upon this is still a
  good TTP to alert some malicious activities.
search: '`powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filter*"
  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
  ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `get_aduser_with_powershell_script_block_filter`'
how_to_implement: The following Hunting analytic requires PowerShell operational logs
  to be imported. Modify the powershell macro as needed to match the sourcetype or
  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: network admin may use this command and other IT operator to
  check AD users.
references:
- https://www.blackhillsinfosec.com/red-blue-purple/
tags:
  analytic_story:
  - Active Directory Discovery
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
  kill_chain_phases:
  - Reconnaissance
  mitre_attack_id:
  - T1087.002
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventCode
  - Message
  - ComputerName
  - User
  security_domain: endpoint
  impact: 50
  confidence: 50
  risk_score: 25
  context:
  - source:endpoint
  - stage:Reconnaissance
  message: powershell process having commandline $Message$ for user enumeration
  observable:
  - name: ComputerName
    type: Hostname
    role:
    - Victim
  - name: User
    type: User
    role:
    - Victim
  automated_detection_testing: passed