Akira Affiliate AD Enumeration: net group/user, nltest, dsquery, AdFind, BloodHound

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•4

Detects reconnaissance activity targeting Active Directory infrastructure using common discovery tools such as AdFind, BloodHound/SharpHound, dsquery, nltest, and native net commands. The rule identifies suspicious patterns by correlating multiple executions or flagging the use of known adversarial enumeration binaries, monitoring for commands that specifically target domain domain-wide information, trust relationships, or domain groups.