{"id":"060c3ef1-fd0a-4091-bf46-e7d625f60b73","title":"Suspicious Get-ADReplAccount","description":"The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory.\nThese include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.\n","author":"frack113","status":"test","level":"medium","date":"2022-02-06","modified":"","tags":["attack.credential-access","attack.t1003.006"],"technique_ids":["T1003.006"],"logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"falsepositives":["Legitimate PowerShell scripts"],"references":["https://www.powershellgallery.com/packages/DSInternals","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.006/T1003.006.md#atomic-test-2---run-dsinternals-get-adreplaccount"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_get_adreplaccount.yml","source_sha256":"644ee411b579330fb74eb8a582fa7011b82ce1046cca6db9682cbe393fb40985","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_get_adreplaccount.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Get-ADReplAccount\nid: 060c3ef1-fd0a-4091-bf46-e7d625f60b73\nstatus: test\ndescription: |\n    The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory.\n    These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.\nreferences:\n    - https://www.powershellgallery.com/packages/DSInternals\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.006/T1003.006.md#atomic-test-2---run-dsinternals-get-adreplaccount\nauthor: frack113\ndate: 2022-02-06\ntags:\n    - attack.credential-access\n    - attack.t1003.006\nlogsource:\n    product: windows\n    category: ps_script\n    definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n    selection:\n        ScriptBlockText|contains|all:\n            - Get-ADReplAccount\n            - '-All '\n            - '-Server '\n    condition: selection\nfalsepositives:\n    - Legitimate PowerShell scripts\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.006","id":"T1003.006","name":"DCSync","page":"techniques/enterprise/T1003.006/"}],"data_path":"data/detection-rules/060c3ef1-fd0a-4091-bf46-e7d625f60b73.json","kind":"sigma"}