Windows PowerView AD Access Control List Enumeration

name: Windows PowerView AD Access Control List Enumeration
id: 39405650-c364-4e1e-a740-32a63ef042a6
version: 12
creation_date: '2023-04-21'
modification_date: '2026-05-13'
author: Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the execution of PowerView PowerShell cmdlets `Get-ObjectAcl` or `Get-DomainObjectAcl`, which are used to enumerate Access Control List (ACL) permissions for Active Directory objects. It leverages Event ID 4104 from PowerShell Script Block Logging to identify this activity. This behavior is significant as it may indicate an attempt to discover weak permissions in Active Directory, potentially leading to privilege escalation. If confirmed malicious, attackers could exploit these permissions to gain unauthorized access or escalate their privileges within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104  (ScriptBlockText=*get-objectacl* OR ScriptBlockText=*Get-DomainObjectAcl*)
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `windows_powerview_ad_access_control_list_enumeration_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.=
known_false_positives: Administrators may leverage PowerView for legitimate purposes, filter as needed.
references:
    - https://attack.mitre.org/techniques/T1078/002/
    - https://medium.com/r3d-buck3t/enumerating-access-controls-in-active-directory-c06e2efa8b89
    - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/abusing-active-directory-acls-aces
    - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainObjectAcl/
finding:
    title: PowerView AD acccess control list enumeration detected on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Active Directory Discovery
    - Active Directory Privilege Escalation
    - Rhysida Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1078.002
    - T1069
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint