PowerShell: Active Directory computer enumeration via Get-AdComputer

Flags PowerShell script blocks using Get-ADComputer with enumeration-related parameters for AD computer discovery.

FreeReviewedSigma · Low · v2

Product: windows
Category: ps_script
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-03-17
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1018Remote System Discovery
- T1087.002Domain Account
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies PowerShell script block content that includes the Get-AdComputer cmdlet followed by common parameters used to enumerate Active Directory computer objects or request their properties. Enumeration helps attackers discover targets, naming patterns, and system attributes for follow-on activity. It relies on Script Block Logging telemetry capturing the executed PowerShell text and parameters.

Reporting behind it

Related detections9 linkedT1087.002 — drag to rearrange

Suspicious Remote Connection to ADWS Port 9389 via security

Suspicious AdFind Active Directory Reconnaissance Tool Execution (via process_creation)

Suspicious Active Directory Enumeration via ADWS PowerShell Cmdlets via ps_script

Windows Process Creation: Renamed AdFind.exe Executions

Windows Process Creation: AdFind Executed with Suspicious Recon Flags

Windows Process Creation: Execution of Net.exe or Net1.exe

Suspicious Active Directory Reconnaissance via ADExplorer or ADRecon (via process_creation)

Suspicious Service Principal Name Enumeration via Setspn by UAT-8837

Suspicious Domain Controller Enumeration via Nltest by DeadLock Ransomware

PowerShell: Active Directory computer enumeration via Get-AdComputer

Pivot detection · T1087.002 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-ad-computer-enumeration-via-get-adcomputer-36bed6b2

title: "PowerShell: Active Directory computer enumeration via Get-AdComputer"
id: 4ba08087-421a-4bd6-b3c7-4e34d9366603
status: test
description: This rule identifies PowerShell script block content that includes the Get-AdComputer cmdlet followed by common parameters used to enumerate Active Directory computer objects or request their properties. Enumeration helps attackers discover targets, naming patterns, and system attributes for follow-on activity. It relies on Script Block Logging telemetry capturing the executed PowerShell text and parameters.
references:
  - https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md
  - https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1087.002/T1087.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_get_adcomputer.yml
author: frack113, Huntrule Team
date: 2022-03-17
modified: 2023-07-08
tags:
  - attack.discovery
  - attack.t1018
  - attack.t1087.002
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_cmdlet:
    ScriptBlockText|contains: "Get-AdComputer "
  selection_option:
    ScriptBlockText|contains:
      - "-Filter "
      - "-LDAPFilter "
      - "-Properties "
  condition: all of selection_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 36bed6b2-e9a0-4fff-beeb-413a92b86138
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL