Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1087.002

Domain Account

Discovery 57 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic AdFind Command Activity production 2026-10-06
splunk Windows Root Domain linked policies Discovery production 2026-10-02
splunk Windows Linked Policies In ADSI Discovery production 2026-10-02
splunk Get DomainUser with PowerShell production 2026-10-02
splunk Get ADUser with PowerShell Script Block production 2026-10-02
splunk Get ADUser with PowerShell production 2026-10-02
splunk Detect SharpHound Usage production 2026-10-02
splunk Detect SharpHound File Modifications production 2026-10-02
splunk Detect SharpHound Command-Line Arguments production 2026-10-02
splunk AdsiSearcher Account Discovery production 2026-10-02
elastic Potential Enumeration via Active Directory Web Service production 2026-09-18
elastic Mounting Hidden or WebDav Remote Shares production 2026-09-18
elastic PowerShell Suspicious Discovery Related Windows API Functions production 2026-09-18
elastic Suspicious Access to LDAP Attributes production 2026-09-18
elastic Enumeration of Administrator Accounts production 2026-09-18
elastic Active Directory Discovery using AdExplorer production 2026-09-18
elastic Enumeration of Users or Groups via Built-in Commands production 2026-09-18
splunk Windows User Discovery Via Net production 2026-08-05
sigma Suspicious Use of PsLogList test 2026-06-29
splunk Windows Forest Discovery with GetForestDomain production 2026-05-13
splunk Detect AzureHound Command-Line Arguments production 2026-05-13
splunk Detect AzureHound File Modifications production 2026-05-13
splunk Domain Account Discovery with Dsquery production 2026-05-13
splunk Domain Account Discovery with Wmic production 2026-05-13
splunk Get DomainUser with PowerShell Script Block production 2026-05-13
splunk GetWmiObject DS User with PowerShell production 2026-05-13
splunk GetWmiObject DS User with PowerShell Script Block production 2026-05-13
splunk Network Traffic to Active Directory Web Services Protocol production 2026-05-13
splunk SchCache Change By App Connect And Create ADSI Object production 2026-05-13
splunk Windows AD Abnormal Object Access Activity production 2026-05-13
splunk Windows AD Privileged Object Access Activity production 2026-05-13
splunk Windows Domain Account Discovery Via Get-NetComputer production 2026-05-13
splunk Windows Find Domain Organizational Units with GetDomainOU production 2026-05-13
splunk Windows Find Interesting ACL with FindInterestingDomainAcl production 2026-05-13
splunk Windows Get Local Admin with FindLocalAdminAccess production 2026-05-13
splunk Windows SOAPHound Binary Execution production 2026-05-13
splunk Windows Suspect Process With Authentication Traffic production 2026-05-13
sigma BloodHound Collection Files test 2026-02-19
sigma Malicious PowerShell Commandlets - ScriptBlock test 2025-12-10
sigma Malicious PowerShell Commandlets - ProcessCreation test 2025-12-10
sigma Malicious PowerShell Commandlets - PoshModule test 2025-12-10
sigma PUA - AdFind Suspicious Execution test 2025-10-24
sigma ADExplorer Writing Complete AD Snapshot Into .dat File experimental 2025-07-09
sigma Suspicious Active Directory Database Snapshot Via ADExplorer test 2025-07-09
sigma Active Directory Database Snapshot Via ADExplorer test 2025-07-09
sigma Potential Active Directory Reconnaissance/Enumeration Via LDAP test 2025-07-04
sigma Renamed AdFind Execution test 2025-02-26
sigma PUA - AdFind.EXE Execution experimental 2025-02-26
sigma Active Directory Computers Enumeration With Get-AdComputer test 2023-07-08
sigma Active Directory Structure Export Via Csvde.EXE test 2023-03-14
sigma PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE test 2023-03-05
sigma Suspicious Group And Account Reconnaissance Activity Using Net.EXE test 2023-03-02
sigma HackTool - Bloodhound/Sharphound Execution test 2023-02-04
sigma Potential AD User Enumeration From Non-Machine Account test 2022-11-08
sigma Reconnaissance Activity test 2022-08-22
sigma AD Privileged Users or Groups Reconnaissance test 2022-07-13
sigma Net.EXE Execution test 2022-07-11