Detection of DirectorySearcher PowerShell Enumeration

This threat brief focuses on detecting PowerShell scripts that leverage the .NET class System.DirectoryServices.DirectorySearcher to perform Active Directory reconnaissance. This method is commonly employed by adversaries during the discovery phase to enumerate domain computers. By programmatically querying the directory, attackers can map out the network structure, identify target systems for lateral movement, and gather environmental intelligence without relying on standard binaries like dsquery or net.exe, which are more frequently monitored by endpoint security tools. Defenders should monitor PowerShell Script Block Logging (Event ID 4104) to identify these scripts, as they exhibit distinct patterns when instantiating the directory searcher, adding specific properties to load, and invoking the FindAll method to return query results.

Impact

Successful execution of this technique allows an attacker to build an inventory of domain-joined systems, facilitating internal network mapping. This information is a precursor to lateral movement, privilege escalation, or targeted data exfiltration within an enterprise Windows environment.

Recommendation

1. Enable Windows PowerShell Script Block Logging (Event ID 4104) across all domain-joined endpoints to capture the full content of executed scripts.
2. Deploy the provided Sigma rule to detect the specific .NET class instantiation and method calls associated with this reconnaissance pattern.
3. Analyze alerts generated by this rule to distinguish between authorized administrative discovery tools and unauthorized attacker scripts.
4. Perform retrospective hunting for the identified PowerShell patterns in SIEM logs to uncover historical unauthorized enumeration attempts.