Threat Hunt: PowerShell-Based Active Directory Reconnaissance
This query detects PowerShell and command-line activities associated with Active Directory reconnaissance, focusing on: - Account & Group Discovery (T1087, T1069) -- Local/Domain user/group enumeration (Get-ADUser, net user, Get-LocalGroupMember). - Password Policy Discovery (T1201) -- Checks domain password rules (Get-ADDefaultDomainPasswordPolicy, net accounts /domain). - Domain Trust & Network Mapping (T1482, T1135, T1016) -- Trust relationships (nltest /domain_trusts), shares (net share), and DNS/IP config (ipconfig). - Lateral Movement Prep (T1021.002, T1213.002) -- SMB share access (net use), AD object/ACL dumping (Get-ADObject). Why It Matters: Adversaries use these commands to map the AD environment before attacks like: - Brute-forcing (using password policy info from T1201). - Privilege escalation (via group membership data from T1069). - Lateral movement (via share/trust discovery from T1135/T1482).
Microsoft Sentinel (KQL)
