Detection of DSInternals PowerShell Module Usage

The DSInternals PowerShell module is an advanced toolkit designed for auditing and manipulating Active Directory (AD) and Azure Active Directory (AAD) internals. While intended for administrative and security research purposes, its capabilities are highly attractive to attackers post-compromise. The module provides functionality for extracting domain secrets, manipulating the NTDS.DIT database file offline, recovering domain controllers from Install from Media (IFM) backups, and performing password auditing. Defenders should focus on identifying the invocation of these specific cmdlets, as their presence in a production environment, especially when executed by non-administrative service accounts or in an ad-hoc manner, often indicates credential harvesting or persistence maintenance activities. Monitoring PowerShell Script Block logs is essential to surface these commands, as they are often executed in-memory to evade traditional disk-based detection.

Impact

Successful usage of these tools can result in complete domain compromise through the extraction of NTDS.DIT files, which contain password hashes for all domain users. Attackers leveraging these utilities can perform offline password cracking, obtain LSA secrets, or inject new objects into the Active Directory database. These actions can lead to massive data exfiltration, persistent unauthorized access, and complete degradation of the identity infrastructure integrity.

Recommendation

Deploy the provided Sigma rule to your SIEM to monitor for PowerShell Script Block executions involving DSInternals-specific cmdlets. Prioritize alerts triggered by service accounts or unusual workstation sources. Ensure that "Script Block Logging" is enabled and correctly forwarded to your centralized logging platform.

Affected OS

• Windows