StrikeShark AD Domain Group Enumeration via net group and BloodHound Tools
Detects reconnaissance activity targeting Active Directory environment information. The rule monitors for common command-line patterns associated with group enumeration, such as the use of 'net' commands for domain group queries, execution of AD enumeration tools like SharpHound/BloodHound, and PowerView PowerShell cmdlets.
Splunk (SPL)
