StrikeShark AD Domain and Group Enumeration via net/nltest/dsquery/fscan

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects high-frequency execution of common Windows reconnaissance tools such as net.exe, nltest.exe, and dsquery.exe, often used by attackers for account or domain enumeration. The rule filters out known administrative processes and Microsoft-signed binaries to reduce noise.