Active Directory Enumeration via net.exe Domain Queries and SharpHound

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•6

Detects reconnaissance activities targeting Active Directory, specifically focusing on the use of common enumeration tools like net.exe, net1.exe, and BloodHound/SharpHound binaries. The rule triggers when multiple enumeration commands or tool-specific execution artifacts are observed, suggesting preparation for lateral movement or privilege escalation.