# Detecting Common User/Domain Recon

#### Key Concepts

* **Active Directory (AD) Domain Reconnaissance**: A critical phase in the attack lifecycle where attackers gather information on the AD environment, seeking knowledge about its:
  * Architecture, network topology, and security setup.
  * Key assets, including Domain Controllers, user accounts, groups, trust relationships, OUs, and GPOs.
* **Objective**: Identify high-value targets, escalate privileges, and enable lateral movement.

#### Recon Techniques with Native Windows Commands

Adversaries may execute commands like `net group` to list Domain Administrators. Common Windows executables used for domain reconnaissance include:

* `whoami /all`
* `wmic computersystem get domain`
* `net user /domain`
* `net group "Domain Admins" /domain`
* `arp -a`
* `nltest /domain_trusts`

**Detection**: Use PowerShell and command-line monitoring to flag unusual command execution.

#### Recon with BloodHound/SharpHound

* **BloodHound**: Open-source tool for visualizing AD relationships, trust paths, permissions, and group memberships.
* **SharpHound**: BloodHound’s C# data collector; commonly run with `-c all` to gather comprehensive data.

#### BloodHound Detection Methods

* **LDAP Queries**: BloodHound collectors perform many LDAP queries on Domain Controllers.
* **Monitoring Techniques**:
  * **Event 1644**: Windows LDAP performance monitoring, though limited in visibility.
  * **ETW Provider (Microsoft-Windows-LDAP-Client)**: Used with tools like **SilkETW** and **SilkService** (supports Yara rule-based query detection).
  * **Predefined LDAP Filters**: Use filters recommended by Microsoft’s ATP team to recognize common reconnaissance LDAP queries.

#### Detecting User/Domain Recon with Splunk

**Objective**: Use Splunk queries to detect common reconnaissance activities in a specific time frame, filtering high-volume noise to focus on suspicious events.

**Detecting Recon Using Native Windows Executables**

**Timeframe**: `earliest=1690447949` to `latest=1690450687`

**Splunk Query**

```
index=main source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventID=1 earliest=1690447949 latest=1690450687
| search process_name IN (arp.exe,chcp.com,ipconfig.exe,net.exe,net1.exe,nltest.exe,ping.exe,systeminfo.exe,whoami.exe) 
  OR (process_name IN (cmd.exe,powershell.exe) AND process IN (*arp*,*chcp*,*ipconfig*,*net*,*net1*,*nltest*,*ping*,*systeminfo*,*whoami*))
| stats values(process) as process, min(_time) as _time by parent_process, parent_process_id, dest, user
| where mvcount(process) > 3
```

**Query Breakdown**

1. **Filter by Index and Source**:
   * Logs are pulled from Sysmon’s process creation events (`EventID=1`) within a specific timeframe.
2. **Process Name Filter**:
   * Targets processes typically associated with reconnaissance commands or command-line tools.
3. **Aggregate with Stats**:
   * Groups results by `parent_process`, `parent_process_id`, `dest`, and `user`, collecting unique processes and earliest timestamps.
4. **Filter by Process Count**:
   * Flags events where more than three reconnaissance-related processes were run by the same parent process.

#### Detecting Recon Using BloodHound

**Timeframe**: `earliest=1690195896` to `latest=1690285475`

**Splunk Query**

```
index=main earliest=1690195896 latest=1690285475 source="WinEventLog:SilkService-Log"
| spath input=Message 
| rename XmlEventData.* as * 
| table _time, ComputerName, ProcessName, ProcessId, DistinguishedName, SearchFilter
| sort 0 _time
| search SearchFilter="*(samAccountType=805306368)*"
| stats min(_time) as _time, max(_time) as maxTime, count, values(SearchFilter) as SearchFilter by ComputerName, ProcessName, ProcessId
| where count > 10
| convert ctime(maxTime)
```

**Query Breakdown**

1. **Filter by Index and Source**:
   * Searches SilkService logs for events within a specified timeframe.
2. **Extract Fields**:
   * `spath` extracts structured fields (e.g., XML data) from `Message`.
3. **Rename and Table**:
   * Renames fields for easier reference and organizes results by key data points.
4. **Filter by LDAP Search Filter**:
   * Detects queries containing `samAccountType=805306368`, often linked to BloodHound’s AD queries.
5. **Statistics Aggregation**:
   * Counts events by `ComputerName`, `ProcessName`, and `ProcessId`, checking for instances with over 10 occurrences.
6. **Convert Timestamp**:
   * Formats `maxTime` to human-readable format for timeline analysis.