Detecting WMI Group Discovery via PowerShell Script Block Logging

This analytic identifies the use of PowerShell to enumerate local or domain groups by querying WMI classes. Attackers often use the Get-WMIObject Win32_Group command during the reconnaissance phase to gain situational awareness of the environment. While administrators may use this command for legitimate configuration management, its execution by unauthorized users or at unexpected times is a common precursor to lateral movement and privilege escalation. By leveraging PowerShell Script Block Logging (EventCode 4104), defenders gain visibility into the full, de-obfuscated script content, enabling effective detection of this enumeration technique. This capability is critical for identifying early-stage attacker activity within an enterprise environment.

Impact

Successful group discovery enables an attacker to map user permissions and identify high-value targets or security groups. This reconnaissance is frequently followed by targeted lateral movement, credential theft, or the elevation of access within the Active Directory domain. Unchecked discovery can facilitate the rapid spread of ransomware or long-term persistence in sensitive network segments.

Recommendation

• Enable PowerShell Script Block Logging (EventCode 4104) across all endpoints to capture the command line content.
• Deploy the provided Sigma rule to identify Get-WMIObject Win32_Group execution in your SIEM.
• Baseline existing administrative scripts that utilize WMI for inventory or management to minimize false positives during incident response.
• Investigate alerts generated by this rule by reviewing the surrounding process context, the identity of the user, and recent lateral movement patterns.