RedVDS - Internal AD Reconnaissance (BloodHound)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•2•0•6

Correlates a successful login from RedVDS infrastructure followed immediately by massive internal directory reconnaissance (e.g., SharpHound execution). This rule detects when an account logs in from a RedVDS IP address and then within an hour executes a process associated with BloodHound or SharpHound for Active Directory reconnaissance.