huntrule

Suspicious Domain Group Enumeration via SharpSploit Get-DomainGroup

PremiumReviewedSigma · Medium · v1
Category
process_creation
Author
HuntRule
Published
2026-11-03
Updated
2026-11-03
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects SharpSploit domain reconnaissance functions being used to enumerate high value Active Directory groups as seen in the WithSecure lab where Get-DomainGroup and Get-DomainUser queries targeted the Domain Admins group prior to lateral movement. Enumeration of privileged groups is a common precursor to privilege escalation and targeted credential theft which is why this behavior is worth surfacing.

Reporting behind it

Related detections9 linkedT1069.002 — drag to rearrange
Suspicious PowerView In-Memory Domain Reconnaissance via Local DownloadString and Invoke-FindLocalAdminAccess (via ps_script)
Suspicious Exchange Trusted Subsystem Group Enumeration via net
Suspicious Active Directory Reconnaissance Commands (via process_creation)
Suspicious SOAPHound Style LDAP Query with SDflags and all_with_list via security
Suspicious SOAPHound Null Filter LDAP Query via security
Suspicious SharpHound Group Enumeration LDAP Filter
Suspicious LDAP Security Descriptor Enumeration via SD_FLAGS Control
Suspicious Delegation Discovery LDAP Search Filter via Bitwise OID
Suspicious Kerberoasting LDAP Search Filter for Service Principal Names
Suspicious Domain Group Enumeration via SharpSploit Get-DomainGroup
Pivot detection · T1069.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.