Detection of Active Directory Enumeration via WMI

This threat involves the use of PowerShell to execute Get-WmiObject queries against the root\directory\ldap namespace, specifically targeting the ds_computer class. This technique is commonly employed by threat actors during the reconnaissance phase of an attack to enumerate Active Directory (AD) computers. By querying the LDAP namespace, an attacker can map the network, identify domain-joined workstations and servers, and subsequently target high-value assets for lateral movement or data exfiltration. Because this activity is highly specific to internal domain discovery, it is considered a strong indicator of malicious intent when observed in environments lacking corresponding authorized administrative work orders.

Attack Chain

1. Initial access is established on a domain-joined endpoint via phishing or exploit.
2. The attacker executes a PowerShell process (powershell.exe or cmd.exe spawning PowerShell).
3. The attacker initiates a WMI query using Get-WmiObject.
4. The query specifically targets the root\directory\ldap namespace to interact with Active Directory.
5. The ds_computer class is specified to retrieve the list of computer objects in the domain.
6. The query results are parsed or exfiltrated to the attacker's C2 to map the network environment.
7. The adversary uses the gathered intelligence to identify target systems for further exploitation or lateral movement.

Impact

Successful execution of this enumeration technique allows an adversary to perform situational awareness within an Active Directory environment. This provides the attacker with a target list of systems, potentially exposing critical servers and workstations. This mapping is a precursor to lateral movement, privilege escalation, and systemic compromise, increasing the risk of data theft or ransomware deployment.

Recommendation

1. Deploy the Sigma rules below to monitor for PowerShell command lines invoking WMI queries against the ds_computer class.
2. Enable process-creation logging (e.g., Sysmon Event ID 1 or Windows Event ID 4688) with full command-line arguments to ensure visibility into PowerShell execution.
3. Baseline the usage of Get-WmiObject in your environment to identify authorized administrative troubleshooting patterns and tune out false positives.
4. Alert on instances where this command is executed by non-administrative user accounts.