splApache-2.0from splunk/security_content

GetDomainComputer with PowerShell Script Block

The following analytic detects the execution of the `Get-DomainComputer` commandlet using PowerShell Script Block Logging (EventCode=4104). This commandlet is part of PowerView, a tool often used for enumerating domain computers within Windows environments. The detection leverages script block text analysis to identify this specific command. Monitoring this activity is crucial as it can indicate an adversary's attempt to gather information about domain computers, which is a common step in Active Directory reconnaissance. If confirmed malicious, this activity could lead to further network enumeration and potential lateral movement within the domain.

Quality

FP risk

—

Forks

Views

Rule sourcedetections/endpoint/getdomaincomputer_with_powershell_script_block.yml

`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainComputer*")
  | fillnull
  | stats count min(_time) as firstTime max(_time) as lastTime
    BY dest signature signature_id
       user_id vendor_product EventID
       Guid Opcode Name
       Path ProcessID ScriptBlockId
       ScriptBlockText
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `getdomaincomputer_with_powershell_script_block_filter`