Potential Active Directory Enumeration Using AD Module via PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•17

Detects the usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dll" DLL. This DLL is often used by attackers to perform Active Directory enumeration, especially in environments where RSAT (Remote Server Administration Tools) are not installed or administrative privileges are not available.