PowerShell DirectorySearcher AD Computer Enumeration via System.DirectoryServices.DirectorySearcher

Flags PowerShell DirectorySearcher queries that load directory properties and enumerate results from Active Directory.

FreeReviewedSigma · Medium · v2

Product: windows
Category: ps_script
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-02-12
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1018Remote System Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies PowerShell script content that constructs a System.DirectoryServices.DirectorySearcher, loads directory searcher properties, and invokes findall to enumerate results. Attackers often use directory querying to discover domain-joined computers before further exploitation or lateral movement. It relies on Script Block Logging telemetry capturing the PowerShell script text containing the specified DirectorySearcher and query method patterns.

Reporting behind it

Related detections9 linkedT1018 — drag to rearrange

Suspicious Domain Controller Enumeration via Nltest by DeadLock Ransomware

Malicious DNS Hosts File Accessed via Network Share (via security)

Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)

Suspicious Remote Connection to ADWS Port 9389 via security

Uncommon Domain Trust Discovery via Nltest (via process_creation)

Suspicious AdFind Active Directory Reconnaissance Tool Execution (via process_creation)

Suspicious Domain Controller and Trust Enumeration via Nltest

Suspicious Active Directory Enumeration via ADWS PowerShell Cmdlets via ps_script

Suspicious Domain Controller Discovery via nltest

PowerShell DirectorySearcher AD Computer Enumeration via System.DirectoryServices.DirectorySearcher

Pivot detection · T1018 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-directorysearcher-active-directory-enumeration-via-directoryservices-1f6399cf

title: PowerShell DirectorySearcher AD Computer Enumeration via System.DirectoryServices.DirectorySearcher
id: 9db693a2-8bc9-4cb9-b3a4-1e7dc31fff86
status: test
description: This rule identifies PowerShell script content that constructs a System.DirectoryServices.DirectorySearcher, loads directory searcher properties, and invokes findall to enumerate results. Attackers often use directory querying to discover domain-joined computers before further exploitation or lateral movement. It relies on Script Block Logging telemetry capturing the PowerShell script text containing the specified DirectorySearcher and query method patterns.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md#atomic-test-15---enumerate-domain-computers-within-active-directory-using-directorysearcher
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_directorysearcher.yml
author: frack113, Huntrule Team
date: 2022-02-12
tags:
  - attack.discovery
  - attack.t1018
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - "New-Object "
      - System.DirectoryServices.DirectorySearcher
      - .PropertiesToLoad.Add
      - .findall()
      - Properties.name
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 1f6399cf-2c80-4924-ace1-6fcff3393480
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL