Detection of PowerShell-based System User Discovery

Adversaries and Red Teams utilize the System.Security.Principal.WindowsIdentity::GetCurrent() .NET method within PowerShell scripts to gather situational awareness on compromised endpoints. By invoking this method, attackers can programmatically resolve the identity of the current user session, a necessary step for refining subsequent Active Directory discovery, identifying targets for privilege escalation, or establishing the account context for lateral movement. While legitimate administrative and troubleshooting activities may invoke this method, its presence within obfuscated or unexpected PowerShell script blocks is a common indicator of unauthorized discovery operations. Detection teams should focus on PowerShell Script Block Logging (EventID 4104) to monitor for calls to this specific .NET class and method.

Impact

Successful execution of this discovery technique allows attackers to map the user landscape on a target host. This intelligence is typically used to tailor post-exploitation activities, such as targeting specific user accounts for credential theft or identifying accounts with higher privileges required for domain-wide lateral movement.

Recommendation

• Deploy the Sigma rule below to monitor for suspicious PowerShell script blocks invoking the WindowsIdentity class.
• Enable PowerShell Script Block Logging (EventID 4104) across all Windows endpoints to capture script execution content.
• Baseline administrative PowerShell usage to identify and tune out common scripting tools that utilize this method for management tasks.
• Investigate occurrences of this pattern in conjunction with other discovery commands, such as 'whoami' or 'net user', to prioritize high-risk alerts.