Detection of PowerView Domain Group Enumeration via PowerShell

Adversaries often utilize the PowerView framework, specifically the Get-DomainGroup cmdlet, to perform Active Directory reconnaissance during the discovery phase of an attack. By executing this command within a PowerShell environment, attackers can identify domain group structures, memberships, and potentially sensitive organizational units. This information is critical for attackers to map out network privileges and identify high-value targets for lateral movement or privilege escalation. Security operations centers should monitor for the execution of PowerShell processes where command-line arguments contain the string Get-DomainGroup, as this activity is frequently associated with unauthorized environment discovery rather than standard administrative tasks.

Attack Chain

1. Attacker gains initial access to a domain-joined workstation or server via phishing or exploitation.
2. Attacker initiates a PowerShell process to begin environment discovery.
3. Attacker imports or executes PowerView scripts (typically memory-resident) to bypass disk-based detection.
4. Attacker executes Get-DomainGroup to query the Active Directory domain controller for group lists.
5. The domain controller returns the requested group membership data to the compromised host.
6. Attacker parses the output to identify privileged groups (e.g., Domain Admins).
7. Attacker uses discovered information to target specific accounts or assets for lateral movement.

Impact

Successful reconnaissance allows attackers to map the internal Active Directory structure, leading to increased efficiency in targeting specific privileged users and assets. This increases the likelihood of successful lateral movement and eventual domain dominance.

Recommendation

Deploy the provided Sigma rule to your SIEM to monitor for PowerShell command-line activity containing Get-DomainGroup. Ensure that Sysmon Event ID 1 or Windows Security Event ID 4688 is enabled across the workstation and server fleet. Investigate all alerts by reviewing the parent process of the suspicious PowerShell execution to determine the initial point of entry. If the activity is confirmed as unauthorized, trigger incident response procedures for host isolation and account audit.