Detection rules › Splunk
Domain Controller Enumeration via nltest (PowerShell)
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Nltest. Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route. This use case detects nltest executions with options dclist or dsgetdc.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery | T1016 System Network Configuration Discovery, T1018 Remote System Discovery |
References
- https://attack.mitre.org/techniques/T1016/
- https://attack.mitre.org/techniques/T1018/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_nltest_recon.yml
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1018/T1018.md#atomic-test-3---remote-system-discovery---nltest
Event coverage
| Provider | Event | Title |
|---|---|---|
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule body yaml
id: '33360.59027'
title: Domain Controller Enumeration via nltest
description: Adversaries may attempt to get a listing of other systems by IP address,
hostname, or other logical identifier on a network that may be used for Lateral
Movement from the current system. Functionality could exist within remote access
tools to enable this, but utilities available on the operating system could also
be used such as Nltest. Adversaries may look for details about the network configuration
and settings, such as IP and/or MAC addresses, of systems they access or through
information discovery of remote systems. Several operating system administration
utilities exist that can be used to gather this information. Examples include Arp,
ipconfig/ifconfig, nbtstat, and route. This use case detects nltest executions with
options dclist or dsgetdc.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
"<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") TERM(nltest) (TERM(dclist)
OR TERM(dsgetdc)) | table _time, host, user, process, process_*, parent_* | bin
span=1s | stats values(*) as * by _time, host '
techniques:
- discovery:system network configuration discovery
- discovery:remote system discovery
technique_id:
- T1016
- T1018
data_category:
- PowerShell logs
references:
- https://attack.mitre.org/techniques/T1016/
- https://attack.mitre.org/techniques/T1018/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_nltest_recon.yml
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1018/T1018.md#atomic-test-3---remote-system-discovery---nltest
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") TERM(nltest) (TERM(dclist) OR TERM(dsgetdc))
Stage 2: table
| table _time, host, user, process, process_*, parent_*
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4103<" |
| 1 | TERM |
| 1 | "<EventID>4104<" |
| 1 | TERM |
| 1 | nltest |
| 1 | TERM |
| 1 | dclist |
| 1 | TERM |
| 1 | dsgetdc |