Skip to content

Commit 8fbd5bf

Browse files
aring87aring87
committed
added triage guides
1 parent 00a64ac commit 8fbd5bf

5 files changed

Lines changed: 474 additions & 0 deletions

‎content/triage-guides/sentinel/discovery/dns-enumeration-via-command-line-tools.md‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
# Triage Guide: DNS Enumeration via Command-Line Tools
2+
3+
## Detection Title
4+
DNS Enumeration via Command-Line Tools
5+
6+
## Objective
7+
8+
This detection identifies execution of command-line utilities commonly used to perform DNS-based enumeration and external lookup activity. These tools may be used to discover hosts, domains, name servers, or public-facing infrastructure.
9+
10+
## Why It Matters
11+
12+
Attackers often use DNS utilities early in an intrusion to:
13+
- resolve internal or external hosts
14+
- identify name servers
15+
- gather domain information
16+
- validate command-and-control infrastructure
17+
- map reachable services or systems
18+
19+
This behavior is not inherently malicious, but it becomes more concerning when used from unusual hosts, by unusual users, or alongside other discovery or staging activity.
20+
21+
## Alert Logic Summary
22+
23+
The rule is intended to identify use of command-line DNS enumeration tooling such as:
24+
- `nslookup`
25+
- `dig`
26+
- `host`
27+
- `whois`
28+
29+
depending on the exact detection logic in the paired rule.
30+
31+
## Initial Triage Questions
32+
33+
- Which tool was used?
34+
- Who executed it?
35+
- Was the execution on a user workstation, admin host, server, or test box?
36+
- Was the target internal or external?
37+
- Is this expected for the user’s role?
38+
- Did the same user or host also perform other discovery actions?
39+
40+
## Investigation Steps
41+
42+
1. Review the full process command line.
43+
2. Identify the executing account and host role.
44+
3. Determine which domains, hosts, or IPs were being queried.
45+
4. Assess whether the tool usage was:
46+
- normal troubleshooting
47+
- administrator activity
48+
- security testing
49+
- broad reconnaissance
50+
5. Look for related discovery activity on the same device:
51+
- `ipconfig`
52+
- `arp`
53+
- `net`
54+
- `nltest`
55+
- `dsquery`
56+
- `systeminfo`
57+
6. Review whether the activity is followed by:
58+
- remote access attempts
59+
- outbound connections
60+
- PowerShell execution
61+
- suspicious downloads
62+
63+
## Common False Positives
64+
65+
- administrator troubleshooting
66+
- network diagnostics
67+
- help desk activity
68+
- server configuration checks
69+
- approved security or infrastructure testing
70+
71+
## Escalation Guidance
72+
73+
Escalate when:
74+
- the user is not expected to perform network enumeration
75+
- the host is a normal user workstation
76+
- the same system shows other discovery or execution behaviors
77+
- the queries target suspicious or attacker-controlled domains
78+
- the activity appears broad, repeated, or scripted
79+
80+
## Recommended Enrichment
81+
82+
- full command line
83+
- queried domains or IPs
84+
- process tree
85+
- user role
86+
- host criticality
87+
- recent discovery commands on the same host
88+
- recent outbound connections
89+
90+
## ATT&CK Mapping
91+
92+
- Discovery
93+
- T1016 – System Network Configuration Discovery
94+
- T1590 / T1596 style pre-attack or recon behaviors, depending on exact usage context
95+
96+
## Related Rule
97+
98+
- `detections/sentinel/discovery/dns-enumeration-via-command-line-tools.yml`

‎content/triage-guides/sentinel/discovery/ldap-enumeration-using-powershell.md‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
# Triage Guide: LDAP Enumeration Using PowerShell
2+
3+
## Detection Title
4+
LDAP Enumeration Using PowerShell
5+
6+
## Objective
7+
8+
This detection identifies PowerShell-based LDAP or Active Directory enumeration activity that may be used to collect information about users, groups, computers, trusts, or organizational structure.
9+
10+
## Why It Matters
11+
12+
LDAP and AD enumeration are common attacker discovery activities used to:
13+
- identify users and privileged accounts
14+
- discover groups and roles
15+
- locate servers or domain controllers
16+
- map trust relationships
17+
- prepare for lateral movement or privilege escalation
18+
19+
PowerShell-based LDAP enumeration is especially important when used from non-admin hosts or by users who do not normally perform directory queries.
20+
21+
## Alert Logic Summary
22+
23+
The rule is intended to identify PowerShell commands or patterns associated with LDAP / AD enumeration, such as:
24+
- `[ADSISearcher]`
25+
- `Get-ADUser`
26+
- `Get-ADComputer`
27+
- `Get-ADGroup`
28+
- LDAP query strings
29+
- PowerShell-based directory search methods
30+
31+
## Initial Triage Questions
32+
33+
- Was the query executed by an admin, engineer, or normal user?
34+
- Was the host expected to perform directory administration?
35+
- Was the PowerShell use interactive, scripted, or remote?
36+
- Did the same session include account enumeration or privileged-group discovery?
37+
- Was the activity followed by authentication attempts or remote execution?
38+
39+
## Investigation Steps
40+
41+
1. Review the full PowerShell command line.
42+
2. Identify the executing account and host type.
43+
3. Determine the scope of enumeration:
44+
- users
45+
- groups
46+
- computers
47+
- trusts
48+
- domain structure
49+
4. Check whether the activity aligns with the user’s normal role.
50+
5. Review surrounding PowerShell activity for:
51+
- encoded commands
52+
- AMSI or logging tampering
53+
- remote execution
54+
- credential access
55+
6. Review whether the same host or account later attempted:
56+
- NTLM auth probing
57+
- WMI / PSRemoting
58+
- group membership enumeration
59+
- admin share access
60+
61+
## Common False Positives
62+
63+
- legitimate AD administration
64+
- identity engineering workflows
65+
- PowerShell-based inventory scripts
66+
- help desk scripts
67+
- authorized security assessments
68+
69+
## Escalation Guidance
70+
71+
Escalate when:
72+
- the activity is from a non-admin workstation
73+
- the user is not expected to enumerate AD
74+
- the activity appears broad or scripted
75+
- it is followed by credential access or lateral movement
76+
- the PowerShell execution context is suspicious
77+
78+
## Recommended Enrichment
79+
80+
- full command line
81+
- PowerShell script block logs if available
82+
- user role and privilege level
83+
- host role
84+
- parent process
85+
- subsequent logon or remote execution activity
86+
- related group / trust / account discovery commands
87+
88+
## ATT&CK Mapping
89+
90+
- Discovery
91+
- T1087 – Account Discovery
92+
- T1069 – Permission Group Discovery
93+
- T1482 – Domain Trust Discovery
94+
- T1018 / T1082 depending on scope
95+
96+
## Related Rule
97+
98+
- `detections/sentinel/discovery/ldap-enumeration-using-powershell.yml`

‎content/triage-guides/sentinel/discovery/net-group-and-domain-trust-discovery.md‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# Triage Guide: Net Group and Domain Trust Discovery
2+
3+
## Detection Title
4+
Net Group and Domain Trust Discovery
5+
6+
## Objective
7+
8+
This detection identifies use of commands associated with group enumeration, domain trust discovery, and related domain reconnaissance.
9+
10+
## Why It Matters
11+
12+
Attackers use group and trust discovery to:
13+
- identify privileged groups
14+
- understand domain relationships
15+
- map administrative boundaries
16+
- identify paths for lateral movement
17+
- identify high-value identity targets
18+
19+
This type of activity is especially relevant in enterprise and domain environments.
20+
21+
## Alert Logic Summary
22+
23+
The rule is intended to identify execution of commands such as:
24+
- `net group`
25+
- `net group /domain`
26+
- `nltest`
27+
- trust-discovery-related commands
28+
- similar domain-recon patterns
29+
30+
## Initial Triage Questions
31+
32+
- Was the command focused on local groups, domain groups, or trust relationships?
33+
- Is the user expected to perform domain administration?
34+
- Did the host also show other AD or account discovery activity?
35+
- Did the same session include remote admin or credential access behavior?
36+
- Was the activity interactive or launched by a script/tool?
37+
38+
## Investigation Steps
39+
40+
1. Review the full command line.
41+
2. Identify whether the target was:
42+
- domain groups
43+
- admin groups
44+
- trust relationships
45+
- domain metadata
46+
3. Review the executing account and host.
47+
4. Determine whether the activity aligns with normal IT/admin duties.
48+
5. Review nearby activity for:
49+
- `net user`
50+
- `whoami /groups`
51+
- PowerShell AD enumeration
52+
- `dsquery`
53+
- `nltest /domain_trusts`
54+
6. Check for follow-on signs of:
55+
- privileged access attempts
56+
- lateral movement
57+
- share enumeration
58+
- service or task creation
59+
60+
## Common False Positives
61+
62+
- domain administration
63+
- troubleshooting trust issues
64+
- identity engineering work
65+
- server onboarding / migration activity
66+
- approved security validation
67+
68+
## Escalation Guidance
69+
70+
Escalate when:
71+
- the user is not expected to perform domain discovery
72+
- the command targets privileged groups or trust relationships
73+
- the host is a normal workstation
74+
- the activity is part of a broader discovery burst
75+
- it is followed by authentication or movement attempts
76+
77+
## Recommended Enrichment
78+
79+
- full command line
80+
- queried group / trust details
81+
- user role
82+
- host sensitivity
83+
- adjacent discovery commands
84+
- related authentication events
85+
- parent process / script context
86+
87+
## ATT&CK Mapping
88+
89+
- Discovery
90+
- T1069 – Permission Group Discovery
91+
- T1482 – Domain Trust Discovery
92+
93+
## Related Rule
94+
95+
- `detections/sentinel/discovery/net-group-and-domain-trust-discovery.yml`

‎content/triage-guides/sentinel/discovery/net-user-enumeration.md‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# Triage Guide: Net User Enumeration
2+
3+
## Detection Title
4+
Net User Enumeration
5+
6+
## Objective
7+
8+
This detection identifies use of `net user` and related commands to enumerate local or domain user accounts.
9+
10+
## Why It Matters
11+
12+
Account enumeration is a common discovery step used to:
13+
- identify valid usernames
14+
- identify privileged or service accounts
15+
- prepare for password spraying
16+
- prepare for lateral movement
17+
- validate targeting opportunities
18+
19+
This command is legitimate in administration, but it is also frequently used by attackers after initial access.
20+
21+
## Alert Logic Summary
22+
23+
The rule is intended to identify use of:
24+
- `net user`
25+
- `net user /domain`
26+
- related account-discovery commands
27+
28+
## Initial Triage Questions
29+
30+
- Who ran `net user`?
31+
- Was it run on a workstation, server, or admin host?
32+
- Was the command local-only or domain-focused?
33+
- Does the user normally perform account administration?
34+
- Were there additional discovery commands nearby?
35+
36+
## Investigation Steps
37+
38+
1. Review the full command line.
39+
2. Identify whether the query targeted:
40+
- local users
41+
- domain users
42+
3. Determine the user and host context.
43+
4. Review neighboring process activity for:
44+
- `net group`
45+
- `whoami`
46+
- `nltest`
47+
- `dsquery`
48+
- PowerShell AD queries
49+
5. Check whether the same account or host later attempted:
50+
- failed logons
51+
- remote execution
52+
- privilege escalation
53+
6. Determine whether the activity was interactive or launched from a script/tool.
54+
55+
## Common False Positives
56+
57+
- legitimate admin troubleshooting
58+
- help desk checks
59+
- server build/configuration workflows
60+
- account administration scripts
61+
62+
## Escalation Guidance
63+
64+
Escalate when:
65+
- the activity is performed by a non-admin user
66+
- it originates from a suspicious or recently compromised host
67+
- it is one step in a larger discovery burst
68+
- it is followed by password spraying or lateral movement
69+
- the user cannot explain the action
70+
71+
## Recommended Enrichment
72+
73+
- full command line
74+
- user account and privilege level
75+
- host type
76+
- nearby discovery commands
77+
- related failed/successful logons
78+
- parent process
79+
- interactive vs scripted execution context
80+
81+
## ATT&CK Mapping
82+
83+
- Discovery
84+
- T1087 – Account Discovery
85+
86+
## Related Rule
87+
88+
- `detections/sentinel/discovery/net-user-enumeration.yml`

0 commit comments

Comments
 (0)