Windows PowerShell imports Microsoft.ActiveDirectory.Management.dll via Import-Module (AD enumeration)
Alerts when PowerShell imports Microsoft.ActiveDirectory.Management.dll using Import-Module, indicating potential AD enumeration.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2023-01-22
- Updated
- 2026-07-30
What it detects
This rule flags process creation where PowerShell (powershell.exe or pwsh.exe) uses Import-Module to load Microsoft.ActiveDirectory.Management.dll. Loading the Active Directory management library is a common prerequisite for attacker-driven directory discovery and enumeration. It relies on Windows process creation telemetry, specifically the executable path, original filename, and the PowerShell command line containing both Import-Module and the target DLL name.
Reporting behind it
- github.comhttps://github.com/samratashok/ADModule
- twitter.comhttps://twitter.com/cyb3rops/status/1617108657166061568?s=20
- ired.teamhttps://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_active_directory_module_dll_import.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-powershell-imports-microsoft-activedirectory-management-dll-via-import-m-70bc5215
title: Windows PowerShell imports Microsoft.ActiveDirectory.Management.dll via Import-Module (AD enumeration)
id: b2093e6f-0f72-42ba-8f7d-6b06c8916828
related:
- id: 9e620995-f2d8-4630-8430-4afd89f77604
type: similar
- id: 74176142-4684-4d8a-8b0a-713257e7df8e
type: similar
- id: 70bc5215-526f-4477-963c-a47a5c9ebd12
type: derived
status: test
description: This rule flags process creation where PowerShell (powershell.exe or pwsh.exe) uses Import-Module to load Microsoft.ActiveDirectory.Management.dll. Loading the Active Directory management library is a common prerequisite for attacker-driven directory discovery and enumeration. It relies on Windows process creation telemetry, specifically the executable path, original filename, and the PowerShell command line containing both Import-Module and the target DLL name.
references:
- https://github.com/samratashok/ADModule
- https://twitter.com/cyb3rops/status/1617108657166061568?s=20
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_active_directory_module_dll_import.yml
author: frack113, Huntrule Team
date: 2023-01-22
tags:
- attack.reconnaissance
- attack.discovery
- attack.impact
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith:
- \powershell.exe
- \pwsh.exe
- OriginalFileName:
- PowerShell.EXE
- pwsh.dll
selection_cmdlet:
CommandLine|contains:
- "Import-Module "
- "ipmo "
selection_dll:
CommandLine|contains: Microsoft.ActiveDirectory.Management.dll
condition: all of selection_*
falsepositives:
- Legitimate use of the library for administrative activity
level: medium
license: DRL-1.1