Domain Group Enumeration - Active Directory Permission Group Discovery
Detects reconnaissance activity targeting Active Directory group structures and membership, utilizing common administrative tools such as net.exe, PowerShell, and dsquery. This rule identifies patterns associated with domain group discovery and identification of privileged accounts.
Microsoft Sentinel (KQL)
