Manipulation of User Computer or Group Security Principals Across AD
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain..
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "PowerShell Script Block Logged" AND SCRIPTEXECUTED contains "System.DirectoryServices.AccountManagement" select Action1.HOSTNAME,Action1.MESSAGE,Action1.SCRIPTEXECUTED
Detection
Execution Mode
realtime
Log Sources
Active Directory
Author
frack113
