Detection of Active Directory Domain User Enumeration via PowerView

This threat brief focuses on the detection of Active Directory reconnaissance activities performed via the PowerView framework. Threat actors often leverage the Get-DomainUser PowerShell cmdlet to identify and enumerate domain users within an environment. This information gathering phase is critical for adversaries aiming to map out organizational structures, identify high-value targets, and prepare for subsequent lateral movement or privilege escalation. The activity typically manifests as execution of PowerShell or CMD processes with command-line arguments containing specific PowerView-related strings. Defenders should prioritize identifying this behavior in high-security zones where internal discovery activities are unlikely to originate from standard endpoints.

Attack Chain

1. Attacker gains initial access to a domain-joined endpoint.
2. Attacker drops or executes the PowerView script within a PowerShell session.
3. Attacker executes the Get-DomainUser cmdlet to query Active Directory.
4. The process (powershell.exe or cmd.exe) calls Active Directory services (LDAP).
5. The Active Directory domain controller returns the list of domain users to the attacker.
6. Attacker processes the returned user objects to identify specific targets or accounts for further exploitation.

Impact

Successful execution of domain enumeration allows attackers to gain significant situational awareness within the target domain. This intelligence is frequently used to identify administrative accounts, service accounts, or users with specific access rights, facilitating targeted lateral movement and escalating the overall impact of the compromise.

Recommendation

1. Deploy the provided Sigma rule to detect Get-DomainUser command-line execution patterns.
2. Ensure EDR process-creation telemetry is configured to capture full command-line arguments.
3. Establish a baseline of normal administrative activity to reduce noise from legitimate troubleshooting.
4. Integrate the identified detection into existing monitoring for Active Directory reconnaissance, specifically looking for process execution chains involving PowerView.