ATT&CK technique

T1069.002

Domain Groups

Discovery 43 detections found

Detection rules

Source	Rule	Status	Updated
elastic	AdFind Command Activity	production	2026-10-06
splunk	GetDomainGroup with PowerShell	production	2026-10-02
splunk	GetAdGroup with PowerShell Script Block	production	2026-10-02
splunk	GetAdGroup with PowerShell	production	2026-10-02
splunk	Domain Group Discovery with Adsisearcher	production	2026-10-02
splunk	Detect SharpHound Usage	production	2026-10-02
splunk	GetDomainGroup with PowerShell Script Block	production	2026-10-02
splunk	Detect SharpHound File Modifications	production	2026-10-02
splunk	Detect SharpHound Command-Line Arguments	production	2026-10-02
splunk	Windows Sensitive Group Discovery With Net	production	2026-10-02
splunk	Windows Ldifde Directory Object Behavior	production	2026-10-02
splunk	Windows Group Discovery Via Net	production	2026-10-02
elastic	Enumeration of Administrator Accounts	production	2026-09-18
elastic	Enumeration of Users or Groups via Built-in Commands	production	2026-09-18
elastic	Potential Enumeration via Active Directory Web Service	production	2026-09-18
elastic	Active Directory Discovery using AdExplorer	production	2026-09-18
elastic	PowerShell Suspicious Discovery Related Windows API Functions	production	2026-09-18
elastic	Suspicious Access to LDAP Attributes	production	2026-09-18
splunk	GetWmiObject Ds Group with PowerShell	production	2026-05-13
splunk	Detect AzureHound Command-Line Arguments	production	2026-05-13
splunk	Detect AzureHound File Modifications	production	2026-05-13
splunk	Domain Group Discovery With Dsquery	production	2026-05-13
splunk	Domain Group Discovery With Wmic	production	2026-05-13
splunk	Elevated Group Discovery with PowerView	production	2026-05-13
splunk	Elevated Group Discovery With Wmic	production	2026-05-13
splunk	GetWmiObject Ds Group with PowerShell Script Block	production	2026-05-13
splunk	Network Traffic to Active Directory Web Services Protocol	production	2026-05-13
splunk	Windows SOAPHound Binary Execution	production	2026-05-13
sigma	BloodHound Collection Files	test	2026-02-19
sigma	Malicious PowerShell Commandlets - PoshModule	test	2025-12-10
sigma	Malicious PowerShell Commandlets - ProcessCreation	test	2025-12-10
sigma	Malicious PowerShell Commandlets - ScriptBlock	test	2025-12-10
sigma	PUA - AdFind Suspicious Execution	test	2025-10-24
sigma	ADExplorer Writing Complete AD Snapshot Into .dat File	experimental	2025-07-09
sigma	Suspicious Active Directory Database Snapshot Via ADExplorer	test	2025-07-09
sigma	Active Directory Database Snapshot Via ADExplorer	test	2025-07-09
sigma	Potential Active Directory Reconnaissance/Enumeration Via LDAP	test	2025-07-04
sigma	Renamed AdFind Execution	test	2025-02-26
sigma	HackTool - SharpView Execution	test	2023-02-14
sigma	HackTool - Bloodhound/Sharphound Execution	test	2023-02-04
sigma	Active Directory Group Enumeration With Get-AdGroup	test	2022-11-17
sigma	Reconnaissance Activity	test	2022-08-22
sigma	Net.EXE Execution	test	2022-07-11