Potential Active Directory Enumeration Using AD Module - PsModule

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.