Active Directory PowerShell module called from a non administrative host

Status: experimental
Severity: medium
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to load the Active Directory PowerShell module on a non administrative host in order to enumerate users, groups, ... Also note that no user information is reported by this event ID and that some correation would be required.

Known false positives

Adminitrative host, jump host, domain controllers, Exchange servers, application interacting with Active Directory modules

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1087.002` Account Discovery: Domain Account

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 600

Rule body

title: Active Directory PowerShell module called from a non administrative host
description: Detects scenarios where an attacker attempts to load the Active Directory PowerShell module on a non administrative host in order to enumerate users, groups, ... Also note that no user information is reported by this event ID and that some correation would be required.
correlation: correlate EventID 600 with ID 800 using field "HostId" or "RunspaceId" to obtain the user that triggered the action.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0007-Discovery/T1087-Account%20discovery
tags:
- attack.discovery
- attack.t1087.002
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 600
    ProviderName: ActiveDirectory
  filter:
    - Computer: '%admin_workstation%'
    - Computer: '%domain_controllers%'
  condition: selection and not filter
falsepositives:
- Adminitrative host, jump host, domain controllers, Exchange servers, application interacting with Active Directory modules
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
  EventID: 600
  ProviderName: ActiveDirectory

Stage 2: `not filter`

filter:
  - Computer: '%admin_workstation%'
  - Computer: '%domain_controllers%'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Computer`	eq	`%admin_workstation%`	`excludes:Computer` `field:"Computer" value:"%admin_workstation%"`
`Computer`	eq	`%domain_controllers%`	`excludes:Computer` `field:"Computer" value:"%domain_controllers%"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ProviderName`	eq	`ActiveDirectory`	`field:"ProviderName" kind:eq value:"ActiveDirectory"`