Active Directory Computers Enumeration With Get-AdComputer

Title: Active Directory Computers Enumeration With Get-AdComputer
Status: test
Description:Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.
References:
  -https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md
  -https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1087.002/T1087.002.md
Author: frack113
Date: 2022-03-17
modified:2023-07-08
Tags:

• -'attack.discovery'
• -'attack.t1018'
• -'attack.t1087.002'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection_cmdlet:
    ScriptBlockText|contains: 'Get-AdComputer '
  selection_option:
    ScriptBlockText|contains:
      -'-Filter '
      -'-LDAPFilter '
      -'-Properties '

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: low