Windows PowerShell Execution of AADInternals Cmdlets (process creation)
Flags PowerShell processes running AADInternals “-AADInt” cmdlets, indicating potential Azure AD/Office 365 administration or abuse.
- Product
- windows
- Category
- process_creation
- Author
- Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-12-23
- Updated
- 2026-07-30
What it detects
This rule identifies Windows process creation events where PowerShell is launched and the command line includes AADInternals cmdlets (e.g., Add-AADInt, Get-AADInt, Invoke-AADInt). Attackers can abuse AADInternals to administer or interact with Azure AD and Office 365, making these cmdlet invocations a useful signal for suspicious automation and recon. It relies on telemetry that records the created process image (powershell.exe/pwsh.exe) and the full command line content.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Execution of AADInternals Cmdlets (process creation)
id: f6813a5c-0fd6-48fc-8bfb-3f6ec91b9e73
related:
- id: 91e69562-2426-42ce-a647-711b8152ced6
type: similar
- id: c86500e9-a645-4680-98d7-f882c70c1ea3
type: derived
status: test
description: This rule identifies Windows process creation events where PowerShell is launched and the command line includes AADInternals cmdlets (e.g., Add-AADInt, Get-AADInt, Invoke-AADInt). Attackers can abuse AADInternals to administer or interact with Azure AD and Office 365, making these cmdlet invocations a useful signal for suspicious automation and recon. It relies on telemetry that records the created process image (powershell.exe/pwsh.exe) and the full command line content.
references:
- https://o365blog.com/aadinternals/
- https://github.com/Gerenios/AADInternals
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_aadinternals_cmdlets_execution.yml
author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2022-12-23
modified: 2025-02-06
tags:
- attack.execution
- attack.reconnaissance
- attack.discovery
- attack.credential-access
- attack.impact
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith:
- \powershell.exe
- \powershell_ise.exe
- \pwsh.exe
- OriginalFileName:
- PowerShell.Exe
- pwsh.dll
selection_cli:
CommandLine|contains:
- Add-AADInt
- ConvertTo-AADInt
- Disable-AADInt
- Enable-AADInt
- Export-AADInt
- Find-AADInt
- Get-AADInt
- Grant-AADInt
- Initialize-AADInt
- Install-AADInt
- Invoke-AADInt
- Join-AADInt
- New-AADInt
- Open-AADInt
- Read-AADInt
- Register-AADInt
- Remove-AADInt
- Reset-AADInt
- Resolve-AADInt
- Restore-AADInt
- Save-AADInt
- Search-AADInt
- Send-AADInt
- Set-AADInt
- Start-AADInt
- Unprotect-AADInt
- Update-AADInt
condition: all of selection_*
falsepositives:
- Legitimate use of the library for administrative activity
level: high
license: DRL-1.1