{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/powerview/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["credential-access","kerberoasting","powerview","active-directory","powershell"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe PowerView tool, a widely used PowerShell-based framework for Active Directory enumeration and exploitation, includes the \u003ccode\u003eGet-DomainSPNTicket\u003c/code\u003e cmdlet specifically designed to facilitate Kerberoasting. Kerberoasting is a well-documented technique where attackers request Kerberos service tickets for services associated with Service Principal Names (SPNs). Because the service ticket is encrypted with the service account's NTLM hash, it can be exported from memory and subjected to offline brute-force attacks to recover the cleartext password.\u003c/p\u003e\n\u003cp\u003eThis activity is commonly observed during the post-exploitation phase of an intrusion, enabling attackers to escalate privileges or move laterally by compromising service accounts that often possess high-level permissions. Detection relies on monitoring PowerShell Script Block Logging (Event ID 4104) for the execution of specific PowerView commandlets, which provides visibility into the intent of the attacker even when commands are obfuscated or run in-memory.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker achieves initial execution on an endpoint within the Active Directory domain.\u003c/li\u003e\n\u003cli\u003eAttacker loads the PowerView framework into the current PowerShell session.\u003c/li\u003e\n\u003cli\u003eAttacker identifies targets by enumerating SPNs within the domain.\u003c/li\u003e\n\u003cli\u003eAttacker executes \u003ccode\u003eGet-DomainSPNTicket\u003c/code\u003e to request service tickets from the Domain Controller.\u003c/li\u003e\n\u003cli\u003eThe Domain Controller issues the requested service tickets to the compromised endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker exports the received tickets from the local cache or memory using tools like Mimikatz or built-in PowerShell commands.\u003c/li\u003e\n\u003cli\u003eAttacker exfiltrates the tickets to an attacker-controlled machine.\u003c/li\u003e\n\u003cli\u003eAttacker performs offline cracking of the extracted hashes to recover service account credentials.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful Kerberoasting can lead to the compromise of highly privileged service accounts, such as those running MSSQL or other critical infrastructure services. This often results in full domain compromise, as these accounts frequently possess high-level privileges in Active Directory. The technique is a common precursor to ransomware deployment and large-scale data exfiltration, as observed in various incidents including the Rhysida ransomware campaigns.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eEnable PowerShell Script Block Logging (Event ID 4104) across all domain-joined endpoints to capture command execution details.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect the execution of \u003ccode\u003eGet-DomainSPNTicket\u003c/code\u003e within your SIEM environment.\u003c/li\u003e\n\u003cli\u003eProactively monitor for unauthorized use of PowerView by administrators and investigate alerts generated by the use of this toolkit by non-admin accounts.\u003c/li\u003e\n\u003cli\u003eImplement strict password policies and consider transitioning to Group Managed Service Accounts (gMSA) to mitigate the impact of Kerberoasting, as these accounts use long, complex, and automatically rotated passwords.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-12T18:18:22Z","date_published":"2026-10-12T18:18:22Z","id":"https://feed.craftedsignal.io/briefs/2026-10-windows-powerview-kerberoasting/","summary":"This brief documents the use of the PowerView PowerShell cmdlet Get-DomainSPNTicket to conduct Kerberoasting, a technique that extracts Kerberos service tickets for offline password cracking.","title":"Detection of PowerView Kerberoasting via Get-DomainSPNTicket","url":"https://feed.craftedsignal.io/briefs/2026-10-windows-powerview-kerberoasting/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["active-directory","discovery","powerview","reconnaissance"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAdversaries often utilize the PowerView framework, specifically the \u003ccode\u003eGet-DomainGroup\u003c/code\u003e cmdlet, to perform Active Directory reconnaissance during the discovery phase of an attack. By executing this command within a PowerShell environment, attackers can identify domain group structures, memberships, and potentially sensitive organizational units. This information is critical for attackers to map out network privileges and identify high-value targets for lateral movement or privilege escalation. Security operations centers should monitor for the execution of PowerShell processes where command-line arguments contain the string \u003ccode\u003eGet-DomainGroup\u003c/code\u003e, as this activity is frequently associated with unauthorized environment discovery rather than standard administrative tasks.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains initial access to a domain-joined workstation or server via phishing or exploitation.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a PowerShell process to begin environment discovery.\u003c/li\u003e\n\u003cli\u003eAttacker imports or executes PowerView scripts (typically memory-resident) to bypass disk-based detection.\u003c/li\u003e\n\u003cli\u003eAttacker executes \u003ccode\u003eGet-DomainGroup\u003c/code\u003e to query the Active Directory domain controller for group lists.\u003c/li\u003e\n\u003cli\u003eThe domain controller returns the requested group membership data to the compromised host.\u003c/li\u003e\n\u003cli\u003eAttacker parses the output to identify privileged groups (e.g., Domain Admins).\u003c/li\u003e\n\u003cli\u003eAttacker uses discovered information to target specific accounts or assets for lateral movement.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful reconnaissance allows attackers to map the internal Active Directory structure, leading to increased efficiency in targeting specific privileged users and assets. This increases the likelihood of successful lateral movement and eventual domain dominance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eDeploy the provided Sigma rule to your SIEM to monitor for PowerShell command-line activity containing \u003ccode\u003eGet-DomainGroup\u003c/code\u003e. Ensure that Sysmon Event ID 1 or Windows Security Event ID 4688 is enabled across the workstation and server fleet. Investigate all alerts by reviewing the parent process of the suspicious PowerShell execution to determine the initial point of entry. If the activity is confirmed as unauthorized, trigger incident response procedures for host isolation and account audit.\u003c/p\u003e\n","date_modified":"2026-10-12T17:46:19Z","date_published":"2026-10-12T17:46:19Z","id":"https://feed.craftedsignal.io/briefs/2026-10-getdomaingroup-powershell/","summary":"Adversaries leverage the PowerView cmdlet 'Get-DomainGroup' via PowerShell to perform Active Directory reconnaissance and identify group memberships for lateral movement.","title":"Detection of PowerView Domain Group Enumeration via PowerShell","url":"https://feed.craftedsignal.io/briefs/2026-10-getdomaingroup-powershell/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["active-directory","discovery","powerview","powershell","reconnaissance"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThis threat brief focuses on the use of the PowerView PowerShell utility to enumerate Active Directory domain trust relationships. Attackers frequently employ the Get-DomainTrust command during the discovery phase of an intrusion to gain a comprehensive understanding of the target network's topology. By identifying trust boundaries, adversaries can pinpoint paths for lateral movement and identify high-value targets within multi-domain or forest environments. This activity is a hallmark of post-exploitation reconnaissance and often precedes attempts to escalate privileges or compromise additional systems. Detection engineers should prioritize monitoring command-line telemetry for the invocation of PowerView modules, as these are rarely used in standard administrative workflows.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains initial access to a workstation or server within the Windows domain.\u003c/li\u003e\n\u003cli\u003eThe attacker performs local system enumeration to identify existing software and capabilities.\u003c/li\u003e\n\u003cli\u003eThe attacker imports the PowerView PowerShell module into the current process memory.\u003c/li\u003e\n\u003cli\u003eThe attacker executes the Get-DomainTrust command to query trust relationships between domains.\u003c/li\u003e\n\u003cli\u003eThe command interacts with the Active Directory service to retrieve trust objects.\u003c/li\u003e\n\u003cli\u003eThe adversary parses the output to identify reachable domains, transitive trusts, and SID filtering policies.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages this information to plan lateral movement tactics toward secondary domains or forest roots.\u003c/li\u003e\n\u003cli\u003eFinal objective is achieved by using the discovered trust data to pivot into restricted environments.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful execution allows attackers to map the architecture of an Active Directory environment, exposing security weaknesses in domain design. This reconnaissance can lead to unauthorized access across departmental boundaries, escalation of privileges, and widespread exfiltration if left undetected.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the implementation of EDR-based command-line monitoring to detect the usage of PowerView-related command strings.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect PowerShell command lines containing 'Get-DomainTrust'.\u003c/li\u003e\n\u003cli\u003eEnsure Sysmon Event ID 1 (Process Creation) or Windows Event ID 4688 is ingested with full command-line arguments.\u003c/li\u003e\n\u003cli\u003eMonitor for PowerShell execution contexts involving imported scripts or modules not identified in the organization's allowed software list.\u003c/li\u003e\n\u003cli\u003eInvestigate any user account associated with Get-DomainTrust execution for signs of credential compromise.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T17:45:12Z","date_published":"2026-10-12T17:45:12Z","id":"https://feed.craftedsignal.io/briefs/2026-10-get-domaintrust/","summary":"Adversaries utilize the PowerView PowerShell module's Get-DomainTrust command to perform Active Directory reconnaissance, facilitating lateral movement planning by mapping domain trust relationships.","title":"Detection of PowerView Get-DomainTrust Reconnaissance","url":"https://feed.craftedsignal.io/briefs/2026-10-get-domaintrust/"}],"language":"en","title":"CraftedSignal Threat Feed - Powerview","version":"https://jsonfeed.org/version/1.1"}