Active Directory Group Enumeration via Net Commands
This rule detects the execution of specific 'net group' and 'net localgroup' commands that are commonly used for Active Directory enumeration. These commands are often leveraged by adversaries to discover domain-level groups, local administrator groups, and domain administrator groups, which can help them identify privileged accounts and plan further attacks. The rule is designed to flag multiple occurrences of these commands within a 15-minute window on a single host, as a single execution might be benign, but repeated executions suggest reconnaissance activity. The detection logic specifically looks for 'net localgroup administrators', 'net group /dom', and 'net group Domain Admins /dom', optionally preceded by 'cmd /c'.
YARA-L
