Windows PowerShell Script Block Logging: AADInternals Cmdlets (Add-AADInt/Invoke-AADInt) Execution

Flags PowerShell script block execution that contains AADInternals cmdlet names (AADInt), indicating potential admin or abuse activity.

FreeUnreviewedSigmahighv1

windows-powershell-script-block-logging-aadinternals-cmdlets-add-aadint-invoke-a-91e69562

title: "Windows PowerShell Script Block Logging: AADInternals Cmdlets (Add-AADInt/Invoke-AADInt) Execution"
id: 06bd7a49-9faf-4171-867c-c2eb5bece231
related:
  - id: c86500e9-a645-4680-98d7-f882c70c1ea3
    type: similar
  - id: 91e69562-2426-42ce-a647-711b8152ced6
    type: derived
status: test
description: This rule identifies PowerShell script blocks that reference AADInternals cmdlets by matching specific AADInt-prefixed function names (for example, Add-AADInt and Invoke-AADInt). Such tooling can be used to administer or interrogate Azure AD and Office 365, and attackers may leverage it to perform reconnaissance, discovery, or credential-access/impact activities. It relies on Script Block Logging telemetry from Windows PowerShell to capture the executed cmdlet text.
references:
  - https://o365blog.com/aadinternals/
  - https://github.com/Gerenios/AADInternals
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_aadinternals_cmdlets_execution.yml
author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2022-12-23
modified: 2025-02-06
tags:
  - attack.execution
  - attack.reconnaissance
  - attack.discovery
  - attack.credential-access
  - attack.impact
logsource:
  product: windows
  category: ps_script
  definition: Script Block Logging must be enable
detection:
  selection:
    ScriptBlockText|contains:
      - Add-AADInt
      - ConvertTo-AADInt
      - Disable-AADInt
      - Enable-AADInt
      - Export-AADInt
      - Find-AADInt
      - Get-AADInt
      - Grant-AADInt
      - Initialize-AADInt
      - Install-AADInt
      - Invoke-AADInt
      - Join-AADInt
      - New-AADInt
      - Open-AADInt
      - Read-AADInt
      - Register-AADInt
      - Remove-AADInt
      - Reset-AADInt
      - Resolve-AADInt
      - Restore-AADInt
      - Save-AADInt
      - Search-AADInt
      - Send-AADInt
      - Set-AADInt
      - Start-AADInt
      - Unprotect-AADInt
      - Update-AADInt
  condition: selection
falsepositives:
  - Legitimate use of the library for administrative activity
level: high
license: DRL-1.1

What it detects

This rule identifies PowerShell script blocks that reference AADInternals cmdlets by matching specific AADInt-prefixed function names (for example, Add-AADInt and Invoke-AADInt). Such tooling can be used to administer or interrogate Azure AD and Office 365, and attackers may leverage it to perform reconnaissance, discovery, or credential-access/impact activities. It relies on Script Block Logging telemetry from Windows PowerShell to capture the executed cmdlet text.

Known false positives

Legitimate use of the library for administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.