splApache-2.0from splunk/security_content

Powershell Get LocalGroup Discovery with Script Block Logging

The following analytic detects the execution of the PowerShell cmdlet `get-localgroup` using PowerShell Script Block Logging (EventCode=4104). This method captures the full command sent to PowerShell, providing detailed visibility into script execution. Monitoring this activity is significant as it can indicate an attempt to enumerate local groups, which may be a precursor to privilege escalation or lateral movement. If confirmed malicious, an attacker could gain insights into group memberships, potentially leading to unauthorized access or privilege abuse. Review parallel processes and the entire script block for comprehensive analysis.

Quality

FP risk

—

Forks

Views

Rule sourcedetections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml

`powershell` EventCode=4104 ScriptBlockText = "*get-localgroup*"
  | fillnull
  | stats count min(_time) as firstTime max(_time) as lastTime
    BY dest signature signature_id
       user_id vendor_product EventID
       Guid Opcode Name
       Path ProcessID ScriptBlockId
       ScriptBlockText
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `powershell_get_localgroup_discovery_with_script_block_logging_filter`