Function: ListDomainControllers()
List Domain Controllers
Query
// This function list all domain controllers that have been active in the last 7 days.
let ListDomainControllers =
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where LocalPort == 88
| where LocalIPType == "FourToSixMapping"
| distinct DeviceName;
// Example
ListDomainControllersAbout this query
Function: ListDomainControllers()
Query Information
Description
This function list all the domain controllers in your environment. Which might be usefull if you are not aware of the syntax to identify them, alternatively this function can also be used to build detections specifically for or filter on domain controllers.
References
- https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/functions/user-defined-functions
- https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-custom-functions?view=o365-worldwide
Defender XDR
// This function list all domain controllers that have been active in the last 7 days.
let ListDomainControllers =
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where LocalPort == 88
| where LocalIPType == "FourToSixMapping"
| distinct DeviceName;
// Example
ListDomainControllers
Sentinel
Explanation
The query defines a function called ListDomainControllers that identifies all domain controllers in your environment that have been active in the last seven days. It does this by examining network events and filtering for specific criteria:
- Time Frame: It looks at events from the past seven days.
- Port: It filters events where the local port is 88, which is commonly used for Kerberos authentication, a service typically running on domain controllers.
- IP Type: It checks for a specific IP type labeled "FourToSixMapping," which might be used to identify domain controllers in certain network configurations.
- Distinct Device Names: It extracts a list of unique device names that meet these criteria, effectively listing the domain controllers.
This function can be used in both Microsoft Defender XDR and Microsoft Sentinel environments to help identify domain controllers or to build specific detections and filters related to them.
Details
Bert-Jan Pals
Released: October 20, 2024
Tables
Keywords
Operators