This activity is commonly observed during the post-exploitation phase of an intrusion, enabling attackers to escalate privileges or move laterally by compromising service accounts that often possess high-level permissions. Detection relies on monitoring PowerShell Script Block Logging (Event ID 4104) for the execution of specific PowerView commandlets, which provides visibility into the intent of the attacker even when commands are obfuscated or run in-memory.

Attack Chain

1. Attacker achieves initial execution on an endpoint within the Active Directory domain.
2. Attacker loads the PowerView framework into the current PowerShell session.
3. Attacker identifies targets by enumerating SPNs within the domain.
4. Attacker executes Get-DomainSPNTicket to request service tickets from the Domain Controller.
5. The Domain Controller issues the requested service tickets to the compromised endpoint.
6. Attacker exports the received tickets from the local cache or memory using tools like Mimikatz or built-in PowerShell commands.
7. Attacker exfiltrates the tickets to an attacker-controlled machine.
8. Attacker performs offline cracking of the extracted hashes to recover service account credentials.

Impact

Successful Kerberoasting can lead to the compromise of highly privileged service accounts, such as those running MSSQL or other critical infrastructure services. This often results in full domain compromise, as these accounts frequently possess high-level privileges in Active Directory. The technique is a common precursor to ransomware deployment and large-scale data exfiltration, as observed in various incidents including the Rhysida ransomware campaigns.

Recommendation

1. Enable PowerShell Script Block Logging (Event ID 4104) across all domain-joined endpoints to capture command execution details.
2. Deploy the provided Sigma rule to detect the execution of Get-DomainSPNTicket within your SIEM environment.
3. Proactively monitor for unauthorized use of PowerView by administrators and investigate alerts generated by the use of this toolkit by non-admin accounts.
4. Implement strict password policies and consider transitioning to Group Managed Service Accounts (gMSA) to mitigate the impact of Kerberoasting, as these accounts use long, complex, and automatically rotated passwords.

Attack Chain

1. Attacker gains initial access to a domain-joined workstation or server via phishing or exploitation.
2. Attacker initiates a PowerShell process to begin environment discovery.
3. Attacker imports or executes PowerView scripts (typically memory-resident) to bypass disk-based detection.
4. Attacker executes Get-DomainGroup to query the Active Directory domain controller for group lists.
5. The domain controller returns the requested group membership data to the compromised host.
6. Attacker parses the output to identify privileged groups (e.g., Domain Admins).
7. Attacker uses discovered information to target specific accounts or assets for lateral movement.

Impact

Successful reconnaissance allows attackers to map the internal Active Directory structure, leading to increased efficiency in targeting specific privileged users and assets. This increases the likelihood of successful lateral movement and eventual domain dominance.

Recommendation

Deploy the provided Sigma rule to your SIEM to monitor for PowerShell command-line activity containing Get-DomainGroup. Ensure that Sysmon Event ID 1 or Windows Security Event ID 4688 is enabled across the workstation and server fleet. Investigate all alerts by reviewing the parent process of the suspicious PowerShell execution to determine the initial point of entry. If the activity is confirmed as unauthorized, trigger incident response procedures for host isolation and account audit.

Attack Chain

1. An attacker gains initial access to a workstation or server within the Windows domain.
2. The attacker performs local system enumeration to identify existing software and capabilities.
3. The attacker imports the PowerView PowerShell module into the current process memory.
4. The attacker executes the Get-DomainTrust command to query trust relationships between domains.
5. The command interacts with the Active Directory service to retrieve trust objects.
6. The adversary parses the output to identify reachable domains, transitive trusts, and SID filtering policies.
7. The attacker leverages this information to plan lateral movement tactics toward secondary domains or forest roots.
8. Final objective is achieved by using the discovered trust data to pivot into restricted environments.

Impact

Successful execution allows attackers to map the architecture of an Active Directory environment, exposing security weaknesses in domain design. This reconnaissance can lead to unauthorized access across departmental boundaries, escalation of privileges, and widespread exfiltration if left undetected.

Recommendation

Prioritize the implementation of EDR-based command-line monitoring to detect the usage of PowerView-related command strings.

• Deploy the provided Sigma rule to detect PowerShell command lines containing 'Get-DomainTrust'.
• Ensure Sysmon Event ID 1 (Process Creation) or Windows Event ID 4688 is ingested with full command-line arguments.
• Monitor for PowerShell execution contexts involving imported scripts or modules not identified in the organization's allowed software list.
• Investigate any user account associated with Get-DomainTrust execution for signs of credential compromise.