Windows PowerShell: Import-Module of Microsoft.ActiveDirectory.Management.dll for AD Enumeration

Detects PowerShell importing Microsoft.ActiveDirectory.Management.dll with Import-Module, often seen during AD enumeration.

FreeUnreviewedSigmamediumv1

windows-powershell-import-module-of-microsoft-activedirectory-management-dll-for-9e620995

title: "Windows PowerShell: Import-Module of Microsoft.ActiveDirectory.Management.dll for AD Enumeration"
id: 1ac95a31-4c16-4f19-930c-5118d255d610
related:
  - id: 70bc5215-526f-4477-963c-a47a5c9ebd12
    type: similar
  - id: 74176142-4684-4d8a-8b0a-713257e7df8e
    type: similar
  - id: 9e620995-f2d8-4630-8430-4afd89f77604
    type: derived
status: test
description: This rule flags PowerShell script block activity that imports the Microsoft.ActiveDirectory.Management.dll module via Import-Module. Loading this AD management DLL is commonly associated with attacker-driven reconnaissance and domain enumeration using PowerShell. It relies on ScriptBlockText telemetry from PowerShell script block logging to match the module import strings.
references:
  - https://github.com/samratashok/ADModule
  - https://twitter.com/cyb3rops/status/1617108657166061568?s=20
  - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_active_directory_module_dll_import.yml
author: frack113, Nasreddine Bencherchali, Huntrule Team
date: 2023-01-22
tags:
  - attack.reconnaissance
  - attack.discovery
  - attack.impact
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enable"
detection:
  selection_generic:
    ScriptBlockText|contains|all:
      - "Import-Module "
      - Microsoft.ActiveDirectory.Management.dll
  selection_specific:
    ScriptBlockText|contains: ipmo Microsoft.ActiveDirectory.Management.dll
  condition: 1 of selection_*
falsepositives:
  - Legitimate use of the library for administrative activity
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell script block activity that imports the Microsoft.ActiveDirectory.Management.dll module via Import-Module. Loading this AD management DLL is commonly associated with attacker-driven reconnaissance and domain enumeration using PowerShell. It relies on ScriptBlockText telemetry from PowerShell script block logging to match the module import strings.

Known false positives

Legitimate use of the library for administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.