StrikeShark Searchall Tool Domain Group Enumeration

Ethan Andrews@eandrews

•updated Jun 26, 2026•1•0•5

Detects the use of the StrikeShark 'Searchall' reconnaissance tool for enumerating domain groups, as well as native Windows 'net' commands and PowerShell cmdlets ('Get-ADGroupMember') used to query sensitive Active Directory groups such as Domain Admins and Enterprise Admins.