huntrule

Suspicious Active Directory Enumeration via ADWS PowerShell Cmdlets via ps_script

PremiumReviewedSigma · Medium · v1
Product
windows
Category
ps_script
Author
HuntRule
Published
2026-05-17
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell script content invoking bulk Active Directory enumeration cmdlets such as Get-ADComputer or Get-ADObject that query the directory over Active Directory Web Services. Threat actors route enumeration through ADWS on port 9389 to avoid classic LDAP monitoring, so wide directory queries via these cmdlets indicate reconnaissance of domain assets and delegation.

Reporting behind it

Related detections9 linkedT1087.002 — drag to rearrange
Suspicious SOAPHound Style LDAP Query with SDflags and all_with_list via security
Windows Process Creation: Renamed AdFind.exe Executions
Windows Process Creation: AdFind Executed with Suspicious Recon Flags
Windows Process Creation: Execution of Net.exe or Net1.exe
Malicious IcedID AdFind Active Directory Reconnaissance via Command Line
Suspicious SOAPHound Null Filter LDAP Query via security
Suspicious LDAP Security Descriptor Enumeration via SD_FLAGS Control
Suspicious Delegation Discovery LDAP Search Filter via Bitwise OID
Suspicious Service Principal Name Discovery via setspn Query
Suspicious Active Directory Enumeration via ADWS PowerShell Cmdlets via ps_script
Pivot detection · T1087.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.