Detection of DSInternals PowerShell Module Usage

The DSInternals PowerShell module is a legitimate administrative toolset designed to interact with internal Active Directory and Azure Active Directory features. However, its capabilities are frequently co-opted by attackers for post-exploitation activities. The toolkit allows for advanced operations including extracting DPAPI backup keys, manipulating offline NTDS.DIT files, auditing passwords, and DC recovery from IFM backups.

Defenders must be aware that the presence of these specific cmdlets in command-line arguments often indicates malicious intent when executed outside of authorized administrative workflows. The module provides deep access to credential stores, making it a high-value target for privilege escalation and data exfiltration. Given its legitimate use case, detection requires distinguishing between authorized administrator activity and suspicious execution patterns by monitoring for the specific cmdlets outlined below.

Impact

Successful abuse of the DSInternals module can lead to full compromise of Active Directory environments. Attackers can extract sensitive credential material, reset passwords, manipulate security accounts, and recover keys that grant persistent access. This toolset enables rapid domain-wide credential harvesting and potential for total domain controller takeover.

Recommendation

Deploy the provided Sigma rule to monitor for execution of DSInternals cmdlets.

• Enable Sysmon or Windows Event ID 4688 with command-line logging to capture full PowerShell execution details.
• Review alerts generated by this rule against known authorized administrative service accounts.
• Investigate any execution of cmdlets such as 'Get-ADDBBackupKey', 'Get-LsaBackupKey', or 'Set-ADDBAccountPassword' to identify unauthorized domain access.