PowerShell ADRecon Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects the execution of ADRecon.ps1, a PowerShell script used for Active Directory reconnaissance. The rule identifies specific function names and a default report filename commonly found within the ADRecon script. This tool has been reported to be actively used by the FIN7 threat group.