Detection of Active Directory Domain Controller Discovery via PowerShell

The 'Get-DomainController' command is a function within the PowerSploit framework used to discover the identity and location of domain controllers within a Windows domain. Adversaries often execute this command as part of the initial reconnaissance phase to map Active Directory environments and identify high-value targets for subsequent lateral movement. This detection analytic focuses on identifying instances where 'powershell.exe' is invoked with command-line arguments containing this specific function name. By monitoring for this activity, defenders can detect potential internal reconnaissance attempts before the attacker progresses to credential harvesting or privilege escalation. This activity is considered a high-signal indicator of unauthorized enumeration within an Active Directory environment.

Impact

Successful reconnaissance allows attackers to gain situational awareness of the domain architecture, which is a precursor to lateral movement, data exfiltration, or domain-wide compromise. Unauthorized discovery of domain infrastructure can lead to the identification of critical assets and further exploitation of the network.

Recommendation

• Deploy the Sigma rule below to detect 'Get-DomainController' usage in PowerShell command lines.
• Ingest process-creation telemetry (Sysmon Event ID 1 or Windows Security Event ID 4688) into the SIEM and ensure the 'CommandLine' field is captured.
• Tune the detection by creating an allowlist for known administrative accounts or authorized security testing tools that may legitimately use PowerSploit functions.