Detection: GetWmiObject User Account with PowerShell Script Block

Description

The following analytic detects the execution of the Get-WmiObject commandlet with the Win32_UserAccount parameter via PowerShell Script Block Logging (EventCode=4104). This method leverages script block text to identify when a list of all local users is being enumerated. This activity is significant as it may indicate an adversary or Red Team operation attempting to gather user information for situational awareness and Active Directory discovery. If confirmed malicious, this could lead to further reconnaissance, privilege escalation, or lateral movement within the network.

Search

1`powershell` EventCode=4104 (ScriptBlockText="*Get-WmiObject*" AND ScriptBlockText="*Win32_UserAccount*") 
2| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
3| `security_content_ctime(firstTime)` 
4| `getwmiobject_user_account_with_powershell_script_block_filter`

Data Source

Name	Platform	Sourcetype	Source
Powershell Script Block Logging 4104	Windows	'xmlwineventlog'	'XmlWinEventLog:Microsoft-Windows-PowerShell/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.

Known False Positives

Administrators or power users may use this PowerShell commandlet for troubleshooting.

Associated Analytic Story

• Active Directory Discovery

• Malicious PowerShell

• Winter Vivern

References

• https://attack.mitre.org/techniques/T1087/001/

• https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 5