From 8551f1684ed4b4c7e4300358ef596e8c7501f9ee Mon Sep 17 00:00:00 2001 From: TheLawsOfChaos Date: Mon, 29 Aug 2022 13:03:40 -0400 Subject: [PATCH] Updated for XML format Updated query to utilize XML format of Windows logs instead of Classic. Replaced the following fields: - Message AS ScriptBlockText - ComputerName AS Computer - User AS UserID Fixed in both the query and the stats line. --- .../endpoint/get_aduser_with_powershell_script_block.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index f061a9f684..472c3eb042 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev is used to return a list of all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filter*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search: '`powershell` EventCode=4104 ScriptBlockText = "*get-aduser*" ScriptBlockText = "*-filter*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText + Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_script_block_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or