Akira Affiliate AD Enumeration - net/nltest/AdFind/BloodHound Pre-Ransomware

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects common tools and techniques used for Active Directory reconnaissance, including domain trust discovery, user and group enumeration, and computer discovery. The rule monitors for the execution of utilities like net.exe, nltest, AdFind, SharpHound, and PowerShell cmdlets associated with Active Directory modules, as well as the opening of files containing reconnaissance output.