Sunturai
Back to results
InformationalSplunk security contentRaven Tait +1

Windows LAPS Password Gathering Via PowerShell Script

Detects attempts to gather LAPS passwords via PowerShell and the ms-Mcs-AdmPwd property. Microsoft LAPS (Local Administrator Password Solution) is a Windows native tool used to manage local Administrator accounts…

Description

Detects attempts to gather LAPS passwords via PowerShell and the ms-Mcs-AdmPwd property. Microsoft LAPS (Local Administrator Password Solution) is a Windows native tool used to manage local Administrator accounts within an AD domain. To keep things simple, instead of requiring an administrator to manually set, rotate, and store the local Administrator passwords, LAPS will do this automatically while providing an easy interface for authorized users to access passwords for recovery and/or other admin-related tasks. The benefits to an organization here are obvious: automate and protect a well-known critical security challenge and free up IT resources on your team. However, the fact that LAPS has so much information means that it provides a potential avenue of attack for malicious actors looking to further compromise an environment. If LAPS isn't properly locked down, an organization can inadvertently allow anybody to grab local Admin powers on a given machine.

Detection logic

Detection requirements

Platform
ContainersIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source category
powershell_script_block_logging_4104

Known benign triggers

  • Some legitimate administrative tasks and authorized tools use PowerShell to access LAPS passwords for maintenance and recovery. Filter alerts to exclude approved administrative activities.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice