/
posh_ps_get_adcomputer.yml
31 lines (31 loc) · 1.12 KB
/
posh_ps_get_adcomputer.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
title: Active Directory Computers Enumeration With Get-AdComputer
id: 36bed6b2-e9a0-4fff-beeb-413a92b86138
status: experimental
description: Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.
references:
- https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md
- https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1087.002/T1087.002.md
author: frack113
date: 2022/03/17
modified: 2023/07/08
tags:
- attack.discovery
- attack.t1018
- attack.t1087.002
logsource:
product: windows
category: ps_script
definition: 'Requirements: Script Block Logging must be enabled'
detection:
selection_cmdlet:
ScriptBlockText|contains: 'Get-AdComputer '
selection_option:
ScriptBlockText|contains:
- '-Filter '
- '-LDAPFilter '
- '-Properties '
condition: all of selection_*
falsepositives:
- Unknown
level: low