Analytics Story: Windows Discovery Techniques

Updated Date: 2026-05-13 ID: f7aba570-7d59-11eb-825e-acde48001122 Author: Michael Hart, Splunk Product: Splunk Enterprise Security

Description

Monitors for behaviors associated with adversaries discovering objects in the environment that can be leveraged in the progression of the attack.

Why it matters

Attackers may not have much if any insight into their target's environment before the initial compromise. Once a foothold has been established, attackers will start enumerating objects in the environment (accounts, services, network shares, etc.) that can be used to achieve their objectives. This Analytic Story provides searches to help identify activities consistent with adversaries gaining knowledge of compromised Windows environments.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Windows Software Discovery Via PowerShell	Query Registry, PowerShell, Software Discovery	Anomaly
Windows EventLog Recon Activity Using Log Query Utilities	Log Enumeration	Anomaly
Windows Detect Network Scanner Behavior	Scanning IP Blocks, Vulnerability Scanning	Anomaly
Detect SharpHound Command-Line Arguments	Local Groups, Domain Groups, Local Account, Domain Account, Domain Trust Discovery	TTP
System Information Discovery Detection	System Information Discovery	TTP
Windows Group Discovery Via Net	Local Groups, Domain Groups	Hunting
Detect AzureHound File Modifications	Local Groups, Domain Groups, Local Account, Domain Account, Domain Trust Discovery	TTP
Detect AzureHound Command-Line Arguments	Local Groups, Domain Groups, Local Account, Domain Account, Domain Trust Discovery	TTP
Windows Netspy Network Scanner Execution	Remote System Discovery, Active Scanning	Anomaly
Detect SharpHound Usage	Local Groups, Domain Groups, Local Account, Domain Account, Domain Trust Discovery	TTP
Network Traffic to Active Directory Web Services Protocol	Local Groups, Domain Groups, Local Account, Domain Account, Domain Trust Discovery	Hunting
Detect SharpHound File Modifications	Local Groups, Domain Groups, Local Account, Domain Account, Domain Trust Discovery	TTP
Windows SOAPHound Binary Execution	Local Groups, Domain Groups, Local Account, Domain Account, Domain Trust Discovery	TTP

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Powershell Script Block Logging 4104	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 3	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`

References

Source: GitHub | Version: 2