PowerShell Script with Password Policy Discovery Capabilities
ELASTIC detection rule by Elastic · Elastic License v2
Identifies PowerShell script block content that queries Active Directory password policy settings using AD cmdlets, GPP
password helpers, or directory searcher attributes. Attackers collect password policy details to tune credential attacks
and target weak configurations.
[metadata]
creation_date = "2023/07/12"
integration = ["windows"]
maturity = "production"
updated_date = "2026/03/24"
[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Identifies PowerShell script block content that queries Active Directory password policy settings using AD cmdlets, GPP
password helpers, or directory searcher attributes. Attackers collect password policy details to tune credential attacks
and target weak configurations.
"""
from = "now-119m"
index = ["winlogbeat-*", "logs-windows.powershell*"]
interval = "60m"
language = "kuery"
license = "Elastic License v2"
name = "PowerShell Script with Password Policy Discovery Capabilities"
note = """## Triage and analysis
> **Disclaimer**:
> This guide was created by humans with the assistance of generative AI. While its contents have been manually curated to include the most valuable information, always validate assumptions and adjust procedures to match your internal runbooks and incident triage and response policies.
### Investigating PowerShell Script with Password Policy Discovery Capabilities
This alert identifies PowerShell script block content consistent with querying Active Directory password policy settings, including default domain policy requirements, fine-grained password policies, or related directory attributes. Adversaries may use these details to tune password guessing attempts and prioritize targets; administrators may also collect this information for auditing and troubleshooting.
#### Key alert fields to review
- `user.name`, `user.domain`, `user.id`: Account execution context for correlation, prioritization, and scoping.
- `host.name`, `host.id`: Host execution context for correlation, prioritization, and scoping.
- `powershell.file.script_block_text`: Script block content that matched the detection logic.
- `powershell.file.script_block_id`, `powershell.sequence`, `powershell.total`: Script block metadata to pivot to other fragments or reconstruct full script content when split across multiple events.
- `file.path`, `file.directory`, `file.name`: File-origin context when the script block is sourced from an on-disk file.
- `powershell.file.script_block_length`: Script block length (size) context.
#### Possible investigation steps
- Review `powershell.file.script_block_text` and identify the discovery method:
- AD password policy cmdlets/functions such as `Get-ADDefaultDomainPasswordPolicy`, `Get-ADFineGrainedPasswordPolicy`, `Get-ADUserResultantPasswordPolicy`, `Get-DomainPolicy`, or `Get-PassPol`.
- Directory searcher patterns such as `defaultNamingContext`, `ActiveDirectory.DirectoryContext`, or `ActiveDirectory.DirectorySearcher`, and referenced properties/attributes like `.MinLengthPassword`, `.MinPasswordAge`, `.MaxPasswordAge`, `minPwdLength`, `minPwdAge`, `maxPwdAge`, or `msDS-PasswordSettings`.
- Helper function use that may attempt to access Group Policy Preference password data (for example, `Get-GPPPassword`).
- Determine scope and intent from the script content:
- Domain-wide enumeration vs querying a specific user/resultant policy.
- Enumeration of fine-grained policy objects (`msDS-PasswordSettings`), which can indicate targeted reconnaissance for weaker settings.
- Evidence of output collection (formatting, exporting, or writing results) that may support later use.
- Validate the execution context using `host.name`, `host.id`, `user.name`, `user.domain`, and `user.id`:
- Confirm the host is an expected location for administrative or audit activity (for example, an admin workstation or management server).
- Assess whether the account context aligns with expected job function and normal host access patterns.
- Determine script origin and how it was introduced when `file.path`, `file.directory`, or `file.name` are present:
- Validate that the script path and name align with approved tooling and standard locations for that host.
- Treat execution from user-writable or temporary locations, or from unfamiliar script names, as higher risk and scope for additional suspicious activity.
- Reconstruct the full script content when it is split across multiple events:
- Pivot on `powershell.file.script_block_id` and order by `powershell.sequence` to rebuild the full script (use `powershell.total` to confirm all fragments are present).
- Preserve the reconstructed content for case notes and scoping.
- Correlate with other activity from the same host and account near `@timestamp` (if available in your telemetry):
- Review additional PowerShell script block logs for related discovery, credential access attempts, or follow-on execution.
- Review process activity to determine how PowerShell was launched (parent process, service/automation context, or interactive use) and whether the launch source is expected for the user/host.
- Review network activity consistent with directory queries or access to domain infrastructure that may indicate broader reconnaissance.
- Review file activity for evidence of staged scripts/modules or stored output containing policy details.
- Review authentication activity for spikes in failed logons, account lockouts, or access to multiple hosts following the discovery.
- Scope and prevalence:
- Look for similar `powershell.file.script_block_text` content executed by the same `user.id` on other hosts to determine whether this is isolated or part of a wider discovery phase.
- Look for similar content on the same `host.id` from other users to identify shared tooling, automation, or a compromised host used to launch reconnaissance.
### False positive analysis
- Authorized identity and directory administration activities (for example, validating password policy requirements during audits, troubleshooting, or policy change reviews).
- Scheduled reporting or compliance workflows that periodically inventory default and fine-grained password policy settings.
- Support investigations that query resultant password policy for a specific user as part of account lifecycle management or lockout investigations.
### Response and remediation
- If the activity is unexpected or cannot be tied to an approved administrative task:
- Isolate the affected host to prevent further reconnaissance.
- Restrict or disable the involved account (`user.id`) and reset credentials according to incident response procedures.
- Preserve evidence, including the reconstructed `powershell.file.script_block_text`, associated `powershell.file.script_block_id` fragments, and any referenced scripts (`file.path`, `file.name`).
- Hunt for follow-on activity associated with password policy discovery, such as password guessing attempts, credential collection, and additional directory enumeration, using the same `user.id`, `host.id`, and timeframe.
- If the script content suggests access to Group Policy Preference password data, treat this as potential credential exposure and rotate any identified credentials and remediate insecure configurations.
- If the activity is confirmed benign:
- Document the approved use case (expected accounts, hosts, and script locations) to speed future triage.
- Apply least-privilege controls to limit where and by whom directory policy discovery can be performed while maintaining audit visibility.
"""
risk_score = 21
rule_id = "fe25d5bc-01fa-494a-95ff-535c29cc4c96"
setup = """## Setup
PowerShell Script Block Logging must be enabled to generate the events used by this rule (e.g., 4104).
Setup instructions: https://ela.st/powershell-logging-setup
"""
severity = "low"
tags = [
"Domain: Endpoint",
"OS: Windows",
"Use Case: Threat Detection",
"Tactic: Discovery",
"Tactic: Execution",
"Data Source: PowerShell Logs",
"Rule Type: BBR",
"Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"
query = '''
event.category: "process" and host.os.type:windows and
(
powershell.file.script_block_text: (
"Get-ADDefaultDomainPasswordPolicy" or
"Get-ADFineGrainedPasswordPolicy" or
"Get-ADUserResultantPasswordPolicy" or
"Get-DomainPolicy" or
"Get-GPPPassword" or
"Get-PassPol"
)
or
powershell.file.script_block_text: (
("defaultNamingContext" or "ActiveDirectory.DirectoryContext" or "ActiveDirectory.DirectorySearcher") and
(
(
".MinLengthPassword" or
".MinPasswordAge" or
".MaxPasswordAge"
) or
(
"minPwdAge" or
"maxPwdAge" or
"minPwdLength"
) or
(
"msDS-PasswordSettings"
)
)
)
) and
not powershell.file.script_block_text : ("sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators") and
not powershell.file.script_block_text : ("43c15630-959c-49e4-a977-758c5cc93408" and "CmdletsToExport" and "ActiveDirectory.Types.ps1xml") and
not file.directory: "C:\Program Files\LogicMonitor\Agent\tmp" and
not user.id : "S-1-5-18"
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1201"
name = "Password Policy Discovery"
reference = "https://attack.mitre.org/techniques/T1201/"
[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"
[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"
[[rule.threat.technique.subtechnique]]
id = "T1552.006"
name = "Group Policy Preferences"
reference = "https://attack.mitre.org/techniques/T1552/006/"
[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[rule.investigation_fields]
field_names = [
"@timestamp",
"user.name",
"user.id",
"user.domain",
"powershell.file.script_block_text",
"powershell.file.script_block_id",
"powershell.sequence",
"powershell.total",
"file.path",
"file.directory",
"file.name",
"process.pid",
"host.name",
"host.id",
"powershell.file.script_block_length"
]