DSInternals PowerShell Module Usage
This rule detects the execution and usage of the DSInternals PowerShell module. DSInternals is a powerful tool that exposes internal features of Active Directory and Azure Active Directory, enabling actions such as dumping DPAPI backup keys, manipulating NTDS.DIT files, auditing FIDO2 and NGC keys, performing password auditing, and recovering Domain Controllers from IFM backups. The rule specifically looks for a wide range of DSInternals cmdlets being executed via the command line.
Sigma
