huntrule

Windows PowerShell Active Directory Group Enumeration via Get-AdGroup Cmdlet

Flags PowerShell script blocks that call Get-ADGroup with -Filter to enumerate Active Directory groups.

FreeReviewedSigma · Low · v2
Product
windows
Category
ps_script
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-03-17
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags PowerShell activity that calls the Get-AdGroup cmdlet with a -Filter parameter, consistent with enumerating Active Directory groups. Attackers commonly use group enumeration to discover access pathways and identify targets for subsequent discovery or privilege escalation. The detection relies on PowerShell Script Block text telemetry (e.g., Script Block Logging) capturing the cmdlet invocation.

Reporting behind it

Related detections9 linkedT1069.002 — drag to rearrange
Suspicious Exchange Trusted Subsystem Group Enumeration via net
Suspicious Active Directory Reconnaissance Commands (via process_creation)
Suspicious SOAPHound Style LDAP Query with SDflags and all_with_list via security
Suspicious SOAPHound Null Filter LDAP Query via security
Suspicious SharpHound Group Enumeration LDAP Filter
Suspicious LDAP Security Descriptor Enumeration via SD_FLAGS Control
Suspicious Delegation Discovery LDAP Search Filter via Bitwise OID
Suspicious Kerberoasting LDAP Search Filter for Service Principal Names
Suspicious Service Principal Name Discovery via setspn Query
Windows PowerShell Active Directory Group Enumeration via Get-AdGroup Cmdlet
Pivot detection · T1069.002 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.