Active Directory Group Enumeration via Get-AdGroup with Filter

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•15

This rule detects the use of the 'Get-AdGroup' PowerShell cmdlet with the '-Filter' parameter to enumerate groups within Active Directory. This activity is often performed by attackers during the discovery phase to identify privileged groups and users.