User Discovery And Export Via Get-ADUser Cmdlet - PowerShell

Title: User Discovery And Export Via Get-ADUser Cmdlet - PowerShell
Status: test
Description:Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file
References:
  -http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
  -https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-11-17
modified:None
Tags:

• -'attack.discovery'
• -'attack.t1033'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains|all:
      -'Get-ADUser '
      -' -Filter \*'

    ScriptBlockText|contains:
      -' > '
      -' | Select '
      -'Out-File'
      -'Set-Content'
      -'Add-Content'

  condition:selection
Falsepositives:
  -Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often
Level: medium