AADInternals PowerShell Cmdlets Execution

SigmaHQ Detections@sigmaHQ

•updated Feb 17, 2025•0•19

Detects the execution of AADInternals PowerShell cmdlets. AADInternals is a tool for administering Azure AD and Office 365, which can be abused by threat actors to attack these services. The rule specifically looks for PowerShell processes executing commands containing the unique string "-AADInt" followed by various cmdlet actions like Add, ConvertTo, Disable, Enable, Export, Find, Get, Grant, Initialize, Install, Invoke, Join, New, Open, Read, Register, Remove, Reset, Resolve, Restore, Save, Search, Send, Set, Start, Unprotect, or Update.