AADInternals PowerShell Cmdlets Execution

SigmaHQ Detections@sigmaHQ

•updated Feb 17, 2025•5•0•32

Detects the execution of AADInternals PowerShell cmdlets. AADInternals is a tool used for administering Azure AD and Office 365, which can be abused by threat actors for various attacks including reconnaissance, credential access, and impact within Azure AD or Office 365 environments. The rule specifically looks for the unique "-AADInt" string prefix in cmdlet names.