Windows Find Domain Organizational Units with GetDomainOU

name: Windows Find Domain Organizational Units with GetDomainOU
id: 0ada2f82-b7af-40cc-b1d7-1e5985afcb4e
version: 11
creation_date: '2023-09-01'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of the `Get-DomainOU` cmdlet, a part of the PowerView toolkit used for Windows domain enumeration. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this activity. Detecting `Get-DomainOU` usage is significant as adversaries may use it to gather information about organizational units within Active Directory, which can facilitate lateral movement or privilege escalation. If confirmed malicious, this activity could allow attackers to map the domain structure, aiding in further exploitation and persistence within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText = "*Get-DomainOU*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_find_domain_organizational_units_with_getdomainou_filter`
how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: Administrators may leverage PowerSploit tools for legitimate reasons, filter as needed.
references:
    - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainOU/
    - https://attack.mitre.org/techniques/T1087/002/
    - https://book.hacktricks.xyz/windows-hardening/basic-powershell-for-pentesters/powerview
finding:
    title: Suspicious PowerShell Get-DomainOU was identified on endpoint $dest$ by user $user_id$.
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Suspicious PowerShell Get-DomainOU was identified on endpoint $dest$ by user $user_id$.
analytic_story:
    - Active Directory Discovery
asset_type: Endpoint
mitre_attack_id:
    - T1087.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint