detection.wiki

Detection rules › Sigma

Active Directory PowerShell module called from a non administrative host

Status
experimental
Severity
medium
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to load the Active Directory PowerShell module on a non administrative host in order to enumerate users, groups, ... Also note that no user information is reported by this event ID and that some correation would be required.

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1087.002 Account Discovery: Domain Account

Rule body yaml

title: Active Directory PowerShell module called from a non administrative host
description: Detects scenarios where an attacker attempts to load the Active Directory PowerShell module on a non administrative host in order to enumerate users, groups, ... Also note that no user information is reported by this event ID and that some correation would be required.
correlation: correlate EventID 600 with ID 800 using field "HostId" or "RunspaceId" to obtain the user that triggered the action.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0007-Discovery/T1087-Account%20discovery
tags:
- attack.discovery
- attack.t1087.002
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 600
    ProviderName: ActiveDirectory
  filter:
    - Computer: '%admin_workstation%'
    - Computer: '%domain_controllers%'
  condition: selection and not filter
falsepositives:
- Adminitrative host, jump host, domain controllers, Exchange servers, application interacting with Active Directory modules
level: medium

Stages and Predicates

Stage 0: condition

selection and not filter

Stage 1: selection

selection:
  EventID: 600
  ProviderName: ActiveDirectory

Stage 2: not filter

filter:
  - Computer: '%admin_workstation%'
  - Computer: '%domain_controllers%'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
Computereq%admin_workstation%
Computereq%domain_controllers%

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ProviderNameeq
  • ActiveDirectory