Windows PowerShell imports Microsoft.ActiveDirectory.Management.dll via Import-Module (AD enumeration)

Alerts when PowerShell imports Microsoft.ActiveDirectory.Management.dll using Import-Module, indicating potential AD enumeration.

FreeUnreviewedSigmamediumv1

windows-powershell-imports-microsoft-activedirectory-management-dll-via-import-m-70bc5215

title: Windows PowerShell imports Microsoft.ActiveDirectory.Management.dll via Import-Module (AD enumeration)
id: b2093e6f-0f72-42ba-8f7d-6b06c8916828
related:
  - id: 9e620995-f2d8-4630-8430-4afd89f77604
    type: similar
  - id: 74176142-4684-4d8a-8b0a-713257e7df8e
    type: similar
  - id: 70bc5215-526f-4477-963c-a47a5c9ebd12
    type: derived
status: test
description: This rule flags process creation where PowerShell (powershell.exe or pwsh.exe) uses Import-Module to load Microsoft.ActiveDirectory.Management.dll. Loading the Active Directory management library is a common prerequisite for attacker-driven directory discovery and enumeration. It relies on Windows process creation telemetry, specifically the executable path, original filename, and the PowerShell command line containing both Import-Module and the target DLL name.
references:
  - https://github.com/samratashok/ADModule
  - https://twitter.com/cyb3rops/status/1617108657166061568?s=20
  - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_active_directory_module_dll_import.yml
author: frack113, Huntrule Team
date: 2023-01-22
tags:
  - attack.reconnaissance
  - attack.discovery
  - attack.impact
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_cmdlet:
    CommandLine|contains:
      - "Import-Module "
      - "ipmo "
  selection_dll:
    CommandLine|contains: Microsoft.ActiveDirectory.Management.dll
  condition: all of selection_*
falsepositives:
  - Legitimate use of the library for administrative activity
level: medium
license: DRL-1.1

What it detects

This rule flags process creation where PowerShell (powershell.exe or pwsh.exe) uses Import-Module to load Microsoft.ActiveDirectory.Management.dll. Loading the Active Directory management library is a common prerequisite for attacker-driven directory discovery and enumeration. It relies on Windows process creation telemetry, specifically the executable path, original filename, and the PowerShell command line containing both Import-Module and the target DLL name.

Known false positives

Legitimate use of the library for administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.