detection.wiki

Detection rules › Sigma

DSInternals Suspicious PowerShell Cmdlets - ScriptBlock

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059.001 Command and Scripting Interpreter: PowerShell

Event coverage

ProviderEvent IDTitle
PowerShell4104Creating Scriptblock text (MessageNumber of MessageTotal).

Stages and Predicates

Stage 1: selection

or:
ScriptBlockText|contains: Add-ADDBSidHistory
ScriptBlockText|contains: Add-ADNgcKey
ScriptBlockText|contains: Add-ADReplNgcKey
ScriptBlockText|contains: 'ConvertFrom-ADManagedPasswordBlob'
ScriptBlockText|contains: ConvertFrom-GPPrefPassword
ScriptBlockText|contains: ConvertFrom-ManagedPasswordBlob
ScriptBlockText|contains: ConvertFrom-UnattendXmlPassword
ScriptBlockText|contains: ConvertFrom-UnicodePassword
ScriptBlockText|contains: ConvertTo-AADHash
ScriptBlockText|contains: ConvertTo-GPPrefPassword
ScriptBlockText|contains: ConvertTo-KerberosKey
ScriptBlockText|contains: ConvertTo-LMHash
ScriptBlockText|contains: ConvertTo-MsoPasswordHash
ScriptBlockText|contains: ConvertTo-NTHash
ScriptBlockText|contains: ConvertTo-OrgIdHash
ScriptBlockText|contains: ConvertTo-UnicodePassword
ScriptBlockText|contains: Disable-ADDBAccount
ScriptBlockText|contains: Enable-ADDBAccount
ScriptBlockText|contains: Get-ADDBAccount
ScriptBlockText|contains: Get-ADDBBackupKey
ScriptBlockText|contains: Get-ADDBDomainController
ScriptBlockText|contains: 'Get-ADDBGroupManagedServiceAccount'
ScriptBlockText|contains: Get-ADDBKdsRootKey
ScriptBlockText|contains: Get-ADDBSchemaAttribute
ScriptBlockText|contains: Get-ADDBServiceAccount
ScriptBlockText|contains: Get-ADDefaultPasswordPolicy
ScriptBlockText|contains: Get-ADKeyCredential
ScriptBlockText|contains: Get-ADPasswordPolicy
ScriptBlockText|contains: Get-ADReplAccount
ScriptBlockText|contains: Get-ADReplBackupKey
ScriptBlockText|contains: Get-ADReplicationAccount
ScriptBlockText|contains: Get-ADSIAccount
ScriptBlockText|contains: Get-AzureADUserEx
ScriptBlockText|contains: Get-BootKey
ScriptBlockText|contains: Get-KeyCredential
ScriptBlockText|contains: Get-LsaBackupKey
ScriptBlockText|contains: Get-LsaPolicy
ScriptBlockText|contains: Get-SamPasswordPolicy
ScriptBlockText|contains: Get-SysKey
ScriptBlockText|contains: Get-SystemKey
ScriptBlockText|contains: New-ADDBRestoreFromMediaScript
ScriptBlockText|contains: New-ADKeyCredential
ScriptBlockText|contains: New-ADNgcKey
ScriptBlockText|contains: New-NTHashSet
ScriptBlockText|contains: Remove-ADDBObject
ScriptBlockText|contains: Save-DPAPIBlob
ScriptBlockText|contains: Set-ADAccountPasswordHash
ScriptBlockText|contains: Set-ADDBAccountPassword
ScriptBlockText|contains: Set-ADDBBootKey
ScriptBlockText|contains: Set-ADDBDomainController
ScriptBlockText|contains: Set-ADDBPrimaryGroup
ScriptBlockText|contains: Set-ADDBSysKey
ScriptBlockText|contains: Set-AzureADUserEx
ScriptBlockText|contains: Set-LsaPolicy
ScriptBlockText|contains: Set-SamAccountPasswordHash
ScriptBlockText|contains: Set-WinUserPasswordHash
ScriptBlockText|contains: Test-ADDBPasswordQuality
ScriptBlockText|contains: Test-ADPasswordQuality
ScriptBlockText|contains: Test-ADReplPasswordQuality
ScriptBlockText|contains: Test-PasswordQuality
ScriptBlockText|contains: Unlock-ADDBAccount
ScriptBlockText|contains: Write-ADNgcKey
ScriptBlockText|contains: Write-ADReplNgcKey

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ScriptBlockTextmatch
  • Add-ADDBSidHistory
  • Add-ADNgcKey
  • Add-ADReplNgcKey
  • ConvertFrom-ADManagedPasswordBlob
  • ConvertFrom-GPPrefPassword
  • ConvertFrom-ManagedPasswordBlob
  • ConvertFrom-UnattendXmlPassword
  • ConvertFrom-UnicodePassword
  • ConvertTo-AADHash
  • ConvertTo-GPPrefPassword
  • ConvertTo-KerberosKey
  • ConvertTo-LMHash
  • ConvertTo-MsoPasswordHash
  • ConvertTo-NTHash
  • ConvertTo-OrgIdHash
  • ConvertTo-UnicodePassword
  • Disable-ADDBAccount
  • Enable-ADDBAccount
  • Get-ADDBAccount
  • Get-ADDBBackupKey
  • Get-ADDBDomainController
  • Get-ADDBGroupManagedServiceAccount
  • Get-ADDBKdsRootKey
  • Get-ADDBSchemaAttribute
  • Get-ADDBServiceAccount
  • Get-ADDefaultPasswordPolicy
  • Get-ADKeyCredential
  • Get-ADPasswordPolicy
  • Get-ADReplAccount corpus 2 (sigma 2)
  • Get-ADReplBackupKey
  • Get-ADReplicationAccount
  • Get-ADSIAccount
  • Get-AzureADUserEx
  • Get-BootKey
  • Get-KeyCredential
  • Get-LsaBackupKey
  • Get-LsaPolicy
  • Get-SamPasswordPolicy
  • Get-SysKey
  • Get-SystemKey
  • New-ADDBRestoreFromMediaScript
  • New-ADKeyCredential
  • New-ADNgcKey
  • New-NTHashSet
  • Remove-ADDBObject
  • Save-DPAPIBlob
  • Set-ADAccountPasswordHash
  • Set-ADDBAccountPassword
  • Set-ADDBBootKey
  • Set-ADDBDomainController
  • Set-ADDBPrimaryGroup
  • Set-ADDBSysKey
  • Set-AzureADUserEx
  • Set-LsaPolicy
  • Set-SamAccountPasswordHash
  • Set-WinUserPasswordHash
  • Test-ADDBPasswordQuality
  • Test-ADPasswordQuality
  • Test-ADReplPasswordQuality
  • Test-PasswordQuality
  • Unlock-ADDBAccount
  • Write-ADNgcKey
  • Write-ADReplNgcKey

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.