Windows PowerShell Active Directory Module Import for Enumeration
Detects PowerShell importing Microsoft.ActiveDirectory.Management.dll with Import-Module, often seen during AD enumeration.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- ps_script
- Author
- frack113, Nasreddine Bencherchali (SigmaHQ), DRL 1.1
- Published
- 2023-01-22
- Updated
- 2026-07-31
What it detects
This rule flags PowerShell script activity that imports the Microsoft.ActiveDirectory.Management DLL via Import-Module, including common shorthand usage. Adversaries may use this module to enumerate Active Directory resources during reconnaissance. It relies on ScriptBlockText content from PowerShell script block logging to match the module import strings.
Reporting behind it
- github.comhttps://github.com/samratashok/ADModule
- twitter.comhttps://twitter.com/cyb3rops/status/1617108657166061568?s=20
- ired.teamhttps://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_active_directory_module_dll_import.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-powershell-import-module-of-microsoft-activedirectory-management-dll-for-9e620995
title: Windows PowerShell Active Directory Module Import for Enumeration
id: 1ac95a31-4c16-4f19-930c-5118d255d610
related:
- id: 70bc5215-526f-4477-963c-a47a5c9ebd12
type: similar
- id: 74176142-4684-4d8a-8b0a-713257e7df8e
type: similar
- id: 9e620995-f2d8-4630-8430-4afd89f77604
type: derived
status: test
description: This rule flags PowerShell script activity that imports the Microsoft.ActiveDirectory.Management DLL via Import-Module, including common shorthand usage. Adversaries may use this module to enumerate Active Directory resources during reconnaissance. It relies on ScriptBlockText content from PowerShell script block logging to match the module import strings.
references:
- https://github.com/samratashok/ADModule
- https://twitter.com/cyb3rops/status/1617108657166061568?s=20
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_active_directory_module_dll_import.yml
author: frack113, Nasreddine Bencherchali, Huntrule Team
date: 2023-01-22
tags:
- attack.reconnaissance
- attack.discovery
- attack.impact
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enable"
detection:
selection_generic:
ScriptBlockText|contains|all:
- "Import-Module "
- Microsoft.ActiveDirectory.Management.dll
selection_specific:
ScriptBlockText|contains: ipmo Microsoft.ActiveDirectory.Management.dll
condition: 1 of selection_*
falsepositives:
- Legitimate use of the library for administrative activity
level: medium
license: DRL-1.1