heroui logo

AdsiSearcher Account Discovery

Splunk Security Content

View Source
Summary
The AdsiSearcher Account Discovery analytic identifies attempts to enumerate domain users by detecting the use of the `[Adsisearcher]` type accelerator in PowerShell, specifically looking for script blocks that contain `[adsisearcher]`, `objectcategory=user`, and the method call `.findAll()`. This technique is typically employed by adversaries to gather information about users in an Active Directory environment, which aids in situational awareness, potential privilege escalation, or lateral movement within a compromised network. The detection leverages PowerShell Script Block Logging (EventCode=4104) to track and alert on these specific actions. In cases where this behavior is confirmed to be malicious, it is crucial for security teams to investigate and respond accordingly to mitigate further risks.
Categories
  • Endpoint
  • Identity Management
  • Infrastructure
Data Sources
  • Persona
  • Process
  • Logon Session
  • Service
ATT&CK Techniques
  • T1087
  • T1087.002
Created: 2024-11-13