Active Directory Enumeration via PowerShell or Net Commands

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•2

This rule detects potential Active Directory enumeration attempts by monitoring for the execution of common command-line tools and PowerShell cmdlets used to query domain information, such as users, groups, and domain controllers.