Awais Munir
@iawaishttps://threatnexus.onlineTrusted contributorCompletionist
15 followers193 downloads1,508 copies159 likes54,085 views
76 detections
Filters
Last updated
All Time
Detection languages
67
9
Categories
18
14
14
10
9
Platforms
69
6
2
2
2
Products / Services
43
13
5
4
3
MITRE Techniques
16
13
12
9
7
CVEs
2
This query detects PowerShell and command-line activities associated with Active Directory reconnaissance, focusing on:
- Account & Group Discovery (T1087, T1069)
-- Local/Domain user/group enumeration (Get-ADUser, net user, Get-LocalGroupMember).
- Password Policy Discovery (T1201)
-- Checks domain password rules (Get-ADDefaultDomainPasswordPolicy, net accounts /domain).
- Domain Trust & Network Mapping (T1482, T1135, T1016)
-- Trust relationships (nltest /domain_trusts), shares (net share), and DNS/IP config (ipconfig).
- Lateral Movement Prep (T1021.002, T1213.002)
-- SMB share access (net use), AD object/ACL dumping (Get-ADObject).
Why It Matters:
Adversaries use these commands to map the AD environment before attacks like:
- Brute-forcing (using password policy info from T1201).
- Privilege escalation (via group membership data from T1069).
- Lateral movement (via share/trust discovery from T1135/T1482).
- Account & Group Discovery (T1087, T1069)
-- Local/Domain user/group enumeration (Get-ADUser, net user, Get-LocalGroupMember).
- Password Policy Discovery (T1201)
-- Checks domain password rules (Get-ADDefaultDomainPasswordPolicy, net accounts /domain).
- Domain Trust & Network Mapping (T1482, T1135, T1016)
-- Trust relationships (nltest /domain_trusts), shares (net share), and DNS/IP config (ipconfig).
- Lateral Movement Prep (T1021.002, T1213.002)
-- SMB share access (net use), AD object/ACL dumping (Get-ADObject).
Why It Matters:
Adversaries use these commands to map the AD environment before attacks like:
- Brute-forcing (using password policy info from T1201).
- Privilege escalation (via group membership data from T1069).
- Lateral movement (via share/trust discovery from T1135/T1482).
Detects command-line and PowerShell attempts to discover Windows domain/local password policies, which adversaries use to plan brute-force attacks or credential exploitation.
Each command is a reconnaissance step to answer:
"How many guesses can I make before lockout?"
"What password complexity rules exist?"
"Which domains have weaker policies?"
This aligns with MITRE’s definition of T1201.
Each command is a reconnaissance step to answer:
"How many guesses can I make before lockout?"
"What password complexity rules exist?"
"Which domains have weaker policies?"
This aligns with MITRE’s definition of T1201.
Detects suspicious driver loads indicative of rootkits or BYOVD attacks. Flags unsigned/non-Microsoft drivers loaded from temp paths or by unusual processes. Targets random-named drivers (e.g., 'a1b2c3.sys'), known vulnerable drivers, and system driver impersonators.
This query detects the creation of archive files (ZIP, 7z, RAR) in common temporary or publicly writable directories (C:\Users\Public\, C:\ProgramData\, C:\Windows\Temp, C:\PerfLogs). The files are written by processes commonly abused in attacks, such as powershell.exe, cmd.exe, 7z.exe, winrar.exe, or explorer.exe.
KQL Query from file: Threat Hunt: Potential Password Spray Attacks
This query detects potential Fox Kitten threat actor activity by analyzing ScheduledTaskCreated events.
It filters for suspicious task names (e.g., "update", "sync", "\Microsoft\Windows\EnterpriseMgmt"), non-system accounts, and risky commands (e.g., powershell, certutil). It also extracts task details, assigns risk levels (HIGH, MEDIUM, LOW) based on command patterns, and orders results by risk and timestamp for prioritized investigation.
It filters for suspicious task names (e.g., "update", "sync", "\Microsoft\Windows\EnterpriseMgmt"), non-system accounts, and risky commands (e.g., powershell, certutil). It also extracts task details, assigns risk levels (HIGH, MEDIUM, LOW) based on command patterns, and orders results by risk and timestamp for prioritized investigation.
Page 8 of 8