detection.wiki

Detection rules › Sigma

Suspicious Get Local Groups Information - PowerShell

Severity
low
Author
frack113
Source
upstream

Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1069.001 Permission Groups Discovery: Local Groups

Event coverage

ProviderEvent IDTitle
PowerShell4104Creating Scriptblock text (MessageNumber of MessageTotal).

Stages and Predicates

Stage 1: selection_localgroup

or:
ScriptBlockText|contains: 'get-localgroup '
ScriptBlockText|contains: 'get-localgroupmember '

Stage 2: all of selection_wmi_module

or:
ScriptBlockText|contains: 'gcim '
ScriptBlockText|contains: 'get-ciminstance '
ScriptBlockText|contains: 'get-wmiobject '
ScriptBlockText|contains: 'gwmi '

Stage 3: all of selection_wmi_class

ScriptBlockText|contains: win32_group

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ScriptBlockTextmatch
  • gcim
  • get-ciminstance
  • get-localgroup
  • get-localgroupmember
  • get-wmiobject
  • gwmi corpus 2 (sigma 2)
  • win32_group

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.