huntrule

Windows PowerShell Script Block Logging: AADInternals Cmdlets (Add-AADInt to Update-AADInt) Execution

Flags PowerShell script block execution that contains AADInternals cmdlet names (AADInt), indicating potential admin or abuse activity.

FreeReviewedSigma · High · v2
Product
windows
Category
ps_script
Author
Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-12-23
Updated
2026-07-31
AnalysisDetection
title: "Windows PowerShell Script Block Logging: AADInternals Cmdlets (Add-AADInt to Update-AADInt) Execution"
id: 06bd7a49-9faf-4171-867c-c2eb5bece231
related:
  - id: c86500e9-a645-4680-98d7-f882c70c1ea3
    type: similar
  - id: 91e69562-2426-42ce-a647-711b8152ced6
    type: derived
status: test
description: This rule identifies PowerShell script blocks that invoke AADInternals cmdlets by matching specific “-AADInt” command names such as Add-AADInt, Get-AADInt, Export-AADInt, Invoke-AADInt, and Update-AADInt. Such activity matters because AADInternals is an administration tool for Azure AD and Office 365 and its use in automated scripts can support malicious reconnaissance, credential access, or impact. Telemetry required is Script Block Logging with captured PowerShell ScriptBlockText content.
references:
  - https://o365blog.com/aadinternals/
  - https://github.com/Gerenios/AADInternals
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_aadinternals_cmdlets_execution.yml
author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2022-12-23
modified: 2025-02-06
tags:
  - attack.execution
  - attack.reconnaissance
  - attack.discovery
  - attack.credential-access
  - attack.impact
logsource:
  product: windows
  category: ps_script
  definition: Script Block Logging must be enable
detection:
  selection:
    ScriptBlockText|contains:
      - Add-AADInt
      - ConvertTo-AADInt
      - Disable-AADInt
      - Enable-AADInt
      - Export-AADInt
      - Find-AADInt
      - Get-AADInt
      - Grant-AADInt
      - Initialize-AADInt
      - Install-AADInt
      - Invoke-AADInt
      - Join-AADInt
      - New-AADInt
      - Open-AADInt
      - Read-AADInt
      - Register-AADInt
      - Remove-AADInt
      - Reset-AADInt
      - Resolve-AADInt
      - Restore-AADInt
      - Save-AADInt
      - Search-AADInt
      - Send-AADInt
      - Set-AADInt
      - Start-AADInt
      - Unprotect-AADInt
      - Update-AADInt
  condition: selection
falsepositives:
  - Legitimate use of the library for administrative activity
level: high
license: DRL-1.1