Potential Active Directory Enumeration Using AD Module via PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the use of PowerShell's 'Import-Module' cmdlet to load the 'Microsoft.ActiveDirectory.Management.dll'. This DLL is part of the Active Directory module and is frequently used by attackers for Active Directory enumeration, especially in environments where RSAT (Remote Server Administration Tools) might not be installed or administrative privileges are not initially present.