PowerShell DirectorySearcher for Active Directory Computer Enumeration

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

This rule detects PowerShell script blocks that utilize the `System.DirectoryServices.DirectorySearcher` object to enumerate Active Directory for computer objects. Specifically, it looks for the creation of this object, the addition of properties to load (like 'name'), and the execution of `findall()` to retrieve results. This behavior is indicative of an attacker attempting to discover domain-joined computers within an Active Directory environment.