Loading malware…
PowerView is a PowerShell-based situational awareness and Active Directory enumeration framework used for post-compromise discovery in Windows domain environments. The provided content associates it with reconnaissance and privilege-escalation-enabling discovery, including Active Directory access control list enumeration via the PowerShell cmdlets Get-ObjectAcl and Get-DomainObjectAcl, which are used to enumerate ACL permissions on AD objects and may reveal weak permissions that could be exploited for unauthorized access or privilege escalation. The content also references PowerView for disabled Kerberos pre-authentication discovery associated with AS-REP Roasting, constrained and unconstrained delegation discovery, Kerberos service ticket and SPN discovery associated with Kerberoasting, and Windows file share discovery via the Invoke-ShareFinder script. PowerView is repeatedly listed alongside other offensive tools such as BloodHound, Mimikatz, Rubeus, CrackMapExec, Cobalt Strike, and adPEAS in Active Directory attack chains and detection content. The content further states that the hacktivist group Twelve used PowerView during destructive intrusions against Russian targets. Detection guidance in the content highlights PowerShell Script Block Logging Event ID 4104, specifically script blocks containing get-objectacl or Get-DomainObjectAcl, as an analytic for identifying PowerView ACL enumeration. The content notes that legitimate administrators may also use PowerView, so detections may require tuning.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
20 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Prominent among the other tools used by Twelve are Cobalt Strike, Mimikatz, Chisel, BloodHound, PowerView, adPEAS, CrackMapExec, Advanced IP Scanner, and PsExec for credential theft, discovery, network mapping, and privilege escalation.
The following analytic detects the execution of PowerView PowerShell cmdlets Get-ObjectAcl or Get-DomainObjectAcl , which are used to enumerate Access Control List (ACL) permissions for Active Directory objects.
The following analytic detects the execution of PowerView PowerShell cmdlets Get-ObjectAcl or Get-DomainObjectAcl , which are used to enumerate Access Control List (ACL) permissions for Active Directory objects.
The following analytic detects the execution of PowerView PowerShell cmdlets Get-ObjectAcl or Get-DomainObjectAcl , which are used to enumerate Access Control List (ACL) permissions for Active Directory objects.
The following analytic detects the execution of PowerView PowerShell cmdlets Get-ObjectAcl or Get-DomainObjectAcl , which are used to enumerate Access Control List (ACL) permissions for Active Directory objects.
The following analytic detects the execution of PowerView PowerShell cmdlets Get-ObjectAcl or Get-DomainObjectAcl , which are used to enumerate Access Control List (ACL) permissions for Active Directory objects.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Write-Host "[+] Working Credentials for $_:$password" - foreground green
New-DomainGroup New-DomainUser Add-DomainGroupMember Set-DomainUserPassword Add-DomainObjectAcl Remove-DomainObjectAcl Set-DomainObject
Hunt Hypothesis Threat actor (TA) created persistence by adding DS Replication permissions for a standard user. MITRE ATT&CK Technique – T1003.006
This lab explores ways of password spraying against Active Directory accounts.
Active Directory Password Spraying This lab explores ways of password spraying against Active Directory accounts.
Resolve-IPAddress Get-IPAddress Get-NetComputerSiteName Get-SiteName Get-DomainSubnet Get-NetSubnet
Get-NetSession Get-NetLoggedon Get-NetRDPSession Find-DomainUserLocation Find-DomainProcess
Get-RegLoggedOn Get-LoggedOnLocal Get-NetLoggedon Get-NetSession Get-LastLoggedOn
# Invoke-ShareFinder ... Invoke-ShareFinder -CheckShareAccess
Get-DomainGroupMember Get-NetGroupMember Get-NetLocalGroup Get-NetLocalGroupMember Find-DomainLocalGroupMember
This script performs some basic discovery of information about the host using built-in PowerShell Cmdlets and WMI queries.
Get-DomainUser Get-NetUser Get-DomainGroup Get-NetGroup Get-DomainComputer Get-NetComputer Get-DomainController Get-NetDomainController
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
PowerView is a PowerShell-based post-exploitation and reconnaissance tool used to enumerate Active Directory objects and permissions, including ACLs, to identify weak permissions that could enable privilege escalation or unauthorized access.
PowerView is a PowerShell tool for Active Directory reconnaissance, enumeration, and attack path discovery, used by both red teams and attackers.
PowerShell-based AD enumeration toolkit used for domain discovery and situational awareness in Windows environments.
PowerView is referenced as a tool used for Active Directory and network share discovery, including file share discovery and ACL enumeration.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.