Windows PowerShell Script Block Logging: AADInternals Cmdlets (Add-AADInt to Update-AADInt) Execution
Flags PowerShell script block execution that contains AADInternals cmdlet names (AADInt), indicating potential admin or abuse activity.
- Product
- windows
- Category
- ps_script
- Author
- Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-12-23
- Updated
- 2026-07-31
What it detects
This rule identifies PowerShell script blocks that invoke AADInternals cmdlets by matching specific “-AADInt” command names such as Add-AADInt, Get-AADInt, Export-AADInt, Invoke-AADInt, and Update-AADInt. Such activity matters because AADInternals is an administration tool for Azure AD and Office 365 and its use in automated scripts can support malicious reconnaissance, credential access, or impact. Telemetry required is Script Block Logging with captured PowerShell ScriptBlockText content.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows PowerShell Script Block Logging: AADInternals Cmdlets (Add-AADInt to Update-AADInt) Execution"
id: 06bd7a49-9faf-4171-867c-c2eb5bece231
related:
- id: c86500e9-a645-4680-98d7-f882c70c1ea3
type: similar
- id: 91e69562-2426-42ce-a647-711b8152ced6
type: derived
status: test
description: This rule identifies PowerShell script blocks that invoke AADInternals cmdlets by matching specific “-AADInt” command names such as Add-AADInt, Get-AADInt, Export-AADInt, Invoke-AADInt, and Update-AADInt. Such activity matters because AADInternals is an administration tool for Azure AD and Office 365 and its use in automated scripts can support malicious reconnaissance, credential access, or impact. Telemetry required is Script Block Logging with captured PowerShell ScriptBlockText content.
references:
- https://o365blog.com/aadinternals/
- https://github.com/Gerenios/AADInternals
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_aadinternals_cmdlets_execution.yml
author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2022-12-23
modified: 2025-02-06
tags:
- attack.execution
- attack.reconnaissance
- attack.discovery
- attack.credential-access
- attack.impact
logsource:
product: windows
category: ps_script
definition: Script Block Logging must be enable
detection:
selection:
ScriptBlockText|contains:
- Add-AADInt
- ConvertTo-AADInt
- Disable-AADInt
- Enable-AADInt
- Export-AADInt
- Find-AADInt
- Get-AADInt
- Grant-AADInt
- Initialize-AADInt
- Install-AADInt
- Invoke-AADInt
- Join-AADInt
- New-AADInt
- Open-AADInt
- Read-AADInt
- Register-AADInt
- Remove-AADInt
- Reset-AADInt
- Resolve-AADInt
- Restore-AADInt
- Save-AADInt
- Search-AADInt
- Send-AADInt
- Set-AADInt
- Start-AADInt
- Unprotect-AADInt
- Update-AADInt
condition: selection
falsepositives:
- Legitimate use of the library for administrative activity
level: high
license: DRL-1.1