• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Recon Environment Enumeration Active Directory CISA Report

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Google SecOps@GoogleSecOps
    •updated Jun 2, 2025•0•0•0

    Detects group enumeration commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into

    YARA-L

    Tags

    TA0007 - DiscoveryT1069.002 - Domain GroupsProcess CreationCommand ExecutionWindowsWindows SysmonWindows Eventlog SecurityWindows Eventlog SystemActive Directory Domain Services

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?