StrikeShark AD Group Enumeration via Security EID 4661 Handle Request or Net.exe Domain Commands

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•4

Detects Active Directory domain group enumeration activities associated with StrikeShark post-compromise tooling. The rule monitors for Event ID 4661 object access requests to domain groups with specific access masks, as well as the execution of reconnaissance commands via net.exe or the usage of SharpGPOAbuse.exe, which are known indicators of StrikeShark operations.