PowerShell Domain Enumeration

Description

The following analytic detects the execution of PowerShell commands used for domain enumeration, such as get-netdomaintrust and get-adgroupmember. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command sent to PowerShell. This activity is significant as it often indicates reconnaissance efforts by an attacker to map out the domain structure and identify key users and groups. If confirmed malicious, this behavior could lead to further targeted attacks, privilege escalation, and unauthorized access to sensitive information within the domain.

Query · spl

`powershell`
EventCode=4104
ScriptBlockText IN (
    *get-netdomaintrust*,
    *get-netforesttrust*,
    *get-addomain*,
    *get-adgroupmember*,
    *get-domainuser*
)
| fillnull
| stats count min(_time) as firstTime
              max(_time) as lastTime
  BY dest signature signature_id
       user_id vendor_product EventID
       Guid Opcode Name
       Path ProcessID ScriptBlockId
       ScriptBlockText
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `powershell_domain_enumeration_filter`

Implementation guide

To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.

Known false positives

  • Legitimate use can be common or expected in certain environments. Filter as needed.

Analyst notes

Known false positives: Legitimate use can be common or expected in certain environments. Filter as needed.

Raw source PowerShell Domain Enumeration · SPL
Esc
Published by splunk/security_content ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
name: PowerShell Domain Enumeration
id: e1866ce2-ca22-11eb-8e44-acde48001122
version: 16
creation_date: '2021-06-15'
modification_date: '2026-06-28'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects the execution of PowerShell commands used for domain enumeration, such as `get-netdomaintrust` and `get-adgroupmember`.
    It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command sent to PowerShell.
    This activity is significant as it often indicates reconnaissance efforts by an attacker to map out the domain structure and identify key users and groups.
    If confirmed malicious, this behavior could lead to further targeted attacks, privilege escalation, and unauthorized access to sensitive information within the domain.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell`
    EventCode=4104
    ScriptBlockText IN (
        *get-netdomaintrust*,
        *get-netforesttrust*,
        *get-addomain*,
        *get-adgroupmember*,
        *get-domainuser*
    )
    | fillnull
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
      BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `powershell_domain_enumeration_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: Legitimate use can be common or expected in certain environments. Filter as needed.
references:
    - https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
    - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
    - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
    - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
    - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
drilldown_searches:
    - name: View the detection results for - "$dest$" and "$user_id$"
      search: '%original_detection_search% | search  dest = "$dest$" user_id = "$user_id$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$dest$" and "$user_id$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user_id$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A suspicious powershell script with the ScriptBlockId [$ScriptBlockId$] contains domain enumeration commands executed on host $dest$
analytic_story:
    - Hermetic Wiper
    - Malicious PowerShell
    - CISA AA23-347A
    - Data Destruction
    - Interlock Ransomware
    - Microsoft WSUS CVE-2025-59287
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration.log
          source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
          sourcetype: XmlWinEventLog
      test_type: unit

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.