AD recon
Active Directory reconnaissance from the command line — enumerating domain admins, trusts, users, or running an AD-mapping tool (BloodHound / SharpHound…
What it detects
Active Directory reconnaissance from the command line — enumerating domain admins, trusts, users, or running an AD-mapping tool (BloodHound / SharpHound / AdFind). After a foothold, attackers map the domain to find privilege paths and targets before moving laterally.
MITRE ATT&CK mapping
False positives and triage
Administrators and inventory tools query AD too. The signal is enumeration from a non-admin workstation, by a user who doesn't normally run these, or a recognized offensive tool (SharpHound/BloodHound). Correlate with the host and account.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/windows/ad_recon.yaml, licensed under the Apache License 2.0.
id: windows.discovery.ad_recon
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [windows]
mitre_techniques: [T1087.002, T1482, T1069.002]
description: |
Active Directory reconnaissance from the command line — enumerating domain
admins, trusts, users, or running an AD-mapping tool (BloodHound / SharpHound /
AdFind). After a foothold, attackers map the domain to find privilege paths and
targets before moving laterally.
match:
command_line_contains_any:
- "Domain Admins"
- "Enterprise Admins"
- "/domain_trusts"
- "nltest /dclist"
- "net group \"domain admins\""
- "SharpHound"
- "Invoke-BloodHound"
- "Get-NetUser"
- "Get-DomainUser"
- "adfind"
- "dsquery *"
correlation_keys: [hostname]
false_positive_guidance: |
Administrators and inventory tools query AD too. The signal is enumeration from a
non-admin workstation, by a user who doesn't normally run these, or a recognized
offensive tool (SharpHound/BloodHound). Correlate with the host and account.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.