LoFP LoFP / legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often

Techniques

Sample rules

User Discovery And Export Via Get-ADUser Cmdlet

Description

Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file

Detection logic

condition: all of selection_*
selection_cli:
  CommandLine|contains:
  - ' > '
  - ' | Select '
  - Out-File
  - Set-Content
  - Add-Content
  CommandLine|contains|all:
  - 'Get-ADUser '
  - ' -Filter \*'
selection_img:
- Image|endswith:
  - \powershell.exe
  - \pwsh.exe
- OriginalFileName:
  - PowerShell.EXE
  - pwsh.dll

Computer Discovery And Export Via Get-ADComputer Cmdlet

Description

Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

Detection logic

condition: all of selection_*
selection_cli:
  CommandLine|contains:
  - ' > '
  - ' | Select '
  - Out-File
  - Set-Content
  - Add-Content
  CommandLine|contains|all:
  - 'Get-ADComputer '
  - ' -Filter \*'
selection_img:
- Image|endswith:
  - \powershell.exe
  - \pwsh.exe
- OriginalFileName:
  - PowerShell.EXE
  - pwsh.dll

User Discovery And Export Via Get-ADUser Cmdlet - PowerShell

Description

Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file

Detection logic

condition: selection
selection:
  ScriptBlockText|contains:
  - ' > '
  - ' | Select '
  - Out-File
  - Set-Content
  - Add-Content
  ScriptBlockText|contains|all:
  - 'Get-ADUser '
  - ' -Filter \*'

Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell

Description

Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

Detection logic

condition: selection
selection:
  ScriptBlockText|contains:
  - ' | Select '
  - Out-File
  - Set-Content
  - Add-Content
  ScriptBlockText|contains|all:
  - 'Get-ADComputer '
  - ' -Filter \*'