Query: detection rule: Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often us
Matching passage: Sigma rule: Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often us. Logsource: windows / process_creation. Rule: title: Potential Active Directory Enumeration Using AD Module - ProcCreation id: 70bc5215-526f-4477-963c-a47a5c9ebd12 related: - id: 9e620995-f2d8-4630-8430-4afd89f77604 type: similar - id: 74176142-4684-4d8a-8b0a-713257e7df8e type: similar status: test description: Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration. references: - https://github.com/samratashok/ADModule - https://twitter.com/cyb3rops/status/1617108657166061568?s=20 - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges author: frack113 date: 2023-01-22 tags: - attack.reconnaissance - attack.discovery - attack.impact logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cmdlet: CommandLine|contains: - 'Import-Module ' - 'ipmo ' selection_dll: CommandLine|contains: Microsoft.ActiveDirectory.Management.dll condition: all of selection_* falsepositives: - Legitimate use of the library for administrative activity level: medium
Near-miss passage: Sigma rule: Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute liv. Logsource: windows / process_creation. Rule: title: Python Inline Command Execution id: 899133d5-4d7c-4a7f-94ee-27355c879d90 status: test description: Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code. references: - https://docs.python.org/3/using/cmdline.html#cmdoption-c - https://www.revshells.com/ - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-02 modified: 2025-10-07 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: python.exe - Image|endswith: - python.exe - python3.exe - python2.exe selection_cli: CommandLine|contains: ' -c' filter_main_python_1: ParentImage|startswith: - C:\Program Files\Python - C:\Program Files (x86)\Python ParentImage|endswith: \python.exe ParentCommandLine|contains: -E -s -m ensurepip -U --default-pip filter_main_python_trace: ParentImage|startswith: - C:\Program Files\Python - C:\Program Files (x86)\Python CommandLine|contains|all: - -W ignore::DeprecationWarning - '[''install'', ''--no-cache-dir'', ''--no-index'', ''--find-links'',' - '''--upgrade'', ''pip''' filter_optional_vscode: - ParentImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe - ParentImage: - C:\Program Files\Microsoft VS Code\Code.exe - C:\Program Files (x86)\Microsoft VS Code\Code.exe filter_optional_pip: CommandLine|contains|all: - <pip-setuptools-caller> - exec(compile( condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Python libraries that use a flag starting with "-c". Filter according to your environment level: medium