Windows PowerShell Execution of AADInternals Cmdlets (process creation)

Flags PowerShell processes running AADInternals “-AADInt” cmdlets, indicating potential Azure AD/Office 365 administration or abuse.

FreeUnreviewedSigmahighv1

windows-powershell-execution-of-aadinternals-cmdlets-process-creation-c86500e9

title: Windows PowerShell Execution of AADInternals Cmdlets (process creation)
id: f6813a5c-0fd6-48fc-8bfb-3f6ec91b9e73
related:
  - id: 91e69562-2426-42ce-a647-711b8152ced6
    type: similar
  - id: c86500e9-a645-4680-98d7-f882c70c1ea3
    type: derived
status: test
description: This rule identifies Windows process creation events where PowerShell is launched and the command line includes AADInternals cmdlets (e.g., Add-AADInt, Get-AADInt, Invoke-AADInt). Attackers can abuse AADInternals to administer or interact with Azure AD and Office 365, making these cmdlet invocations a useful signal for suspicious automation and recon. It relies on telemetry that records the created process image (powershell.exe/pwsh.exe) and the full command line content.
references:
  - https://o365blog.com/aadinternals/
  - https://github.com/Gerenios/AADInternals
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_aadinternals_cmdlets_execution.yml
author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2022-12-23
modified: 2025-02-06
tags:
  - attack.execution
  - attack.reconnaissance
  - attack.discovery
  - attack.credential-access
  - attack.impact
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \powershell_ise.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.Exe
        - pwsh.dll
  selection_cli:
    CommandLine|contains:
      - Add-AADInt
      - ConvertTo-AADInt
      - Disable-AADInt
      - Enable-AADInt
      - Export-AADInt
      - Find-AADInt
      - Get-AADInt
      - Grant-AADInt
      - Initialize-AADInt
      - Install-AADInt
      - Invoke-AADInt
      - Join-AADInt
      - New-AADInt
      - Open-AADInt
      - Read-AADInt
      - Register-AADInt
      - Remove-AADInt
      - Reset-AADInt
      - Resolve-AADInt
      - Restore-AADInt
      - Save-AADInt
      - Search-AADInt
      - Send-AADInt
      - Set-AADInt
      - Start-AADInt
      - Unprotect-AADInt
      - Update-AADInt
  condition: all of selection_*
falsepositives:
  - Legitimate use of the library for administrative activity
level: high
license: DRL-1.1

What it detects

This rule identifies Windows process creation events where PowerShell is launched and the command line includes AADInternals cmdlets (e.g., Add-AADInt, Get-AADInt, Invoke-AADInt). Attackers can abuse AADInternals to administer or interact with Azure AD and Office 365, making these cmdlet invocations a useful signal for suspicious automation and recon. It relies on telemetry that records the created process image (powershell.exe/pwsh.exe) and the full command line content.

Known false positives

Legitimate use of the library for administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.