MexicanMafia Impacket/BloodHound AD Enumeration via mini_imp or SharpHound

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

Detects the execution of known offensive security toolkits commonly used for Active Directory enumeration and exploitation, including Impacket (mini_imp) and BloodHound/SharpHound. The rule monitors for command-line arguments and file creation artifacts associated with these tools.