Pre-Ransomware AD Enumeration: BloodHound, SharpHound, PowerView, and net1 Multi-Language Admin Group Discovery

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•6

Detects frequent execution of common Active Directory enumeration tools (such as BloodHound/SharpHound, AdFind) and suspicious LDAP attribute queries targeting sensitive AD information (e.g., group membership, service principal names). The rule triggers when an individual user performs more than three such operations within the aggregation window.