PowerShell ADRecon Execution

Title: PowerShell ADRecon Execution
Status: test
Description:Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7
References:
  -https://github.com/sense-of-security/ADRecon/blob/11881a24e9c8b207f31b56846809ce1fb189bcc9/ADRecon.ps1
  -https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319
Author: Bhabesh Raj
Date: 2021-07-16
modified:2022-09-06
Tags:

• -'attack.discovery'
• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains:
      -'Function Get-ADRExcelComOb'
      -'Get-ADRGPO'
      -'Get-ADRDomainController'
      -'ADRecon-Report.xlsx'

  condition:selection
Falsepositives:
  -Unknown
Level: high