Impacket AD Enum and BloodHound/SharpHound Execution for Privileged Account Discovery

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

This rule detects the execution of common Active Directory enumeration and exploitation tools, specifically Impacket (secretsdump, getuserspns, ntlmrelayx) and BloodHound/SharpHound, by monitoring Windows Sysmon process creation events for known file names and command-line arguments.