Windows PowerShell Active Directory Group Enumeration via Get-AdGroup Cmdlet

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1069.002Domain Groups
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell activity that calls the Get-AdGroup cmdlet with a -Filter parameter, consistent with enumerating Active Directory groups. Attackers commonly use group enumeration to discover access pathways and identify targets for subsequent discovery or privilege escalation. The detection relies on PowerShell Script Block text telemetry (e.g., Script Block Logging) capturing the cmdlet invocation.

Reporting behind it

Related detections9 linkedT1069.002 — drag to rearrange

Malicious Active Directory Enumeration via SharpHound or BloodHound (via process_creation)

Suspicious Group Discovery - Command (via process_creation)

SharpHound Host Enumeration Over Kerberos (via security)

Suspicious Group Discovery - PowerShell (via powershell)

Suspicious Domain Admins Group Enumeration via net.exe (via process_creation)

Suspicious Domain Computers Group Enumeration via Net Command (via process_creation)

Suspicious Active Directory Enumeration via ADWS PowerShell Cmdlets via ps_script

Suspicious Domain Trust Discovery via Nltest

Windows File Events: ADExplorer .dat Snapshot Written by ADExp.exe or ADExplorer.exe

Windows PowerShell Active Directory Group Enumeration via Get-AdGroup Cmdlet

Pivot detection · T1069.002 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-ad-group-enumeration-via-get-adgroup-cmdlet-8c3a6607

title: Windows PowerShell Active Directory Group Enumeration via Get-AdGroup Cmdlet
id: 9e36ae21-6108-4132-8f74-505a44558d2b
status: test
description: This rule flags PowerShell activity that calls the Get-AdGroup cmdlet with a -Filter parameter, consistent with enumerating Active Directory groups. Attackers commonly use group enumeration to discover access pathways and identify targets for subsequent discovery or privilege escalation. The detection relies on PowerShell Script Block text telemetry (e.g., Script Block Logging) capturing the cmdlet invocation.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_get_adgroup.yml
author: frack113, Huntrule Team
date: 2022-03-17
modified: 2022-11-17
tags:
  - attack.discovery
  - attack.t1069.002
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - "Get-AdGroup "
      - -Filter
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 8c3a6607-b7dc-4f0d-a646-ef38c00b76ee
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL