AS-REP Roasting Enumeration via Get-ADUser
Detection of PowerShell activity used to enumerate Active Directory accounts with the DONT_REQ_PREAUTH flag, a precursor to AS-REP roasting attacks.
Attackers often perform reconnaissance within Active Directory to identify accounts that do not require Kerberos pre-authentication. By targeting these accounts, attackers can request the TGT (Ticket Granting Ticket) for the user without needing the user's password, subsequently offline cracking the encrypted hash to recover cleartext credentials. This technique, known as AS-REP roasting, relies on the DONT_REQ_PREAUTH flag being set on an account's UserAccountControl attribute. Security teams can detect this reconnaissance phase by monitoring PowerShell Script Block logs for specific queries using the Get-ADUser cmdlet that utilize bitwise operations (-band) to filter for the value 4194304, which corresponds to the pre-authentication requirement flag.
Impact
Successful enumeration allows an attacker to identify high-value targets or service accounts misconfigured for weaker authentication, leading to account takeover and potential lateral movement within the enterprise network.
Recommendation
Deploy the provided Sigma rule to monitor for suspicious PowerShell command patterns related to AD account enumeration. Enable Windows PowerShell Script Block Logging (Event ID 4104) across all domain-joined endpoints to ensure visibility into the script content.
Immediate actions
Enable PowerShell Script Block Logging (Event ID 4104) and deploy detection rule
Threat Hunt
Search for historical Event ID 4104 logs containing the string '4194304' to identify past discovery attempts
Data: PowerShell Operational Logs
Detection coverage 1
Detect Get-ADUser Enumeration for AS-REP Roasting Targets
mediumDetects PowerShell execution of Get-ADUser filtering for accounts where the DONT_REQ_PREAUTH flag (4194304) is enabled, indicating potential AS-REP roasting enumeration.
Detection queries are available on the platform. Get full rules →