Windows Domain Account Discovery Via Get-NetComputer

This analytic detects the execution of the PowerView PowerShell cmdlet `Get-NetComputer` when it is used to query Active Directory for specific user account details such as "samaccountname," "accountexpires," "lastlogon," "lastlogoff," "pwdlastset," or "logoncount." It leverages Event ID 4104 from PowerShell Script Block Logging to identify this activity. This behavior is significant as it may indicate an attempt to gather user account information, which is often a precursor to further malicious actions like unauthorized access, privilege escalation, or lateral movement within the network.