Detectionmediumtest

Potential Active Directory Enumeration Using AD Module - PsModule

Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Nasreddine Bencherchali (Nextron Systems), François HubautCreated Sun Jan 2274176142-4684-4d8a-8b0a-713257e7df8ewindows
Log Source
WindowsPowerShell Module
ProductWindows← raw: windows
CategoryPowerShell Module← raw: ps_module

Definition

0ad03ef1-f21b-4a79-8ce8-e6900c54b65b

Detection Logic
Detection Logic2 selectors
detection:
    selection_cmdlet:
        Payload|contains:
            - 'Import-Module '
            - 'ipmo '
    selection_dll:
        Payload|contains: 'Microsoft.ActiveDirectory.Management.dll'
    condition: all of selection_*
False Positives

Legitimate use of the library for administrative activity