Domain Account Discovery via net.exe, dsquery, or AdFind (T1087.002)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•4

Detects the execution of common command-line utilities (net.exe, dsquery.exe, AdFind.exe) used to query Active Directory for user information. This pattern is characteristic of adversary discovery activities targeting domain user accounts and group memberships. The rule filters out processes launched by Microsoft-signed binaries to reduce noise.