Windows PowerShell Active Directory Module Load via Import-Module

Flags PowerShell importing Microsoft.ActiveDirectory.Management.dll via Import-Module, a common step in AD discovery and enumeration.

FreeUnreviewedSigmamediumv1

windows-powershell-active-directory-module-load-via-import-module-74176142

title: Windows PowerShell Active Directory Module Load via Import-Module
id: 461eeb5e-54ef-4cb6-b64c-2312182880bf
related:
  - id: 70bc5215-526f-4477-963c-a47a5c9ebd12
    type: similar
  - id: 9e620995-f2d8-4630-8430-4afd89f77604
    type: similar
  - id: 74176142-4684-4d8a-8b0a-713257e7df8e
    type: derived
status: test
description: This rule identifies PowerShell activity that imports the Microsoft.ActiveDirectory.Management.dll using Import-Module (including the ipmo alias). Loading this AD management library is a prerequisite for common Active Directory discovery and enumeration workflows, which attackers may use to map domains, users, or other directory objects. It relies on PowerShell module-loading telemetry capturing the payload content and the presence of both the Import-Module invocation and the specific AD DLL string.
references:
  - https://github.com/samratashok/ADModule
  - https://twitter.com/cyb3rops/status/1617108657166061568?s=20
  - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_active_directory_module_dll_import.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2023-01-22
tags:
  - attack.reconnaissance
  - attack.discovery
  - attack.impact
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection_cmdlet:
    Payload|contains:
      - "Import-Module "
      - "ipmo "
  selection_dll:
    Payload|contains: Microsoft.ActiveDirectory.Management.dll
  condition: all of selection_*
falsepositives:
  - Legitimate use of the library for administrative activity
level: medium
license: DRL-1.1

What it detects

This rule identifies PowerShell activity that imports the Microsoft.ActiveDirectory.Management.dll using Import-Module (including the ipmo alias). Loading this AD management library is a prerequisite for common Active Directory discovery and enumeration workflows, which attackers may use to map domains, users, or other directory objects. It relies on PowerShell module-loading telemetry capturing the payload content and the presence of both the Import-Module invocation and the specific AD DLL string.

Known false positives

Legitimate use of the library for administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.