huntrule

Suspicious Active Directory Enumeration via ADWS PowerShell Cmdlets via ps_script

PremiumReviewedSigma · Medium · v1
Product
windows
Category
ps_script
Author
HuntRule
Published
2026-05-17
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell script content invoking bulk Active Directory enumeration cmdlets such as Get-ADComputer or Get-ADObject that query the directory over Active Directory Web Services. Threat actors route enumeration through ADWS on port 9389 to avoid classic LDAP monitoring, so wide directory queries via these cmdlets indicate reconnaissance of domain assets and delegation.

Reporting behind it

Related detections9 linkedT1087.002 — drag to rearrange
Windows Process Creation: Renamed AdFind.exe Executions
Windows Process Creation: AdFind Executed with Suspicious Recon Flags
Windows Process Creation: Execution of Net.exe or Net1.exe
Malicious Active Directory Enumeration via SharpHound or BloodHound (via process_creation)
Suspicious Group Discovery - Command (via process_creation)
SharpHound Host Enumeration Over Kerberos (via security)
Suspicious Remote Connection to ADWS Port 9389 via security
Suspicious AdFind Active Directory Reconnaissance Tool Execution (via process_creation)
Windows File Events: ADExplorer .dat Snapshot Written by ADExp.exe or ADExplorer.exe
Suspicious Active Directory Enumeration via ADWS PowerShell Cmdlets via ps_script
Pivot detection · T1087.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.