This note documents detection patterns related to Active Directory Enumeration within Windows environments.

Direct Indicators

Indirect Indicators

Common Tools

Relevant Artifacts

• Security Event ID 4688
• Sysmon Event IDs 1, 3, 22
• Security Event ID 4662
• PowerShell 4104
• Prefetch:
  • NLTEST.EXE
  • NET.EXE
  • DSQUERY.EXE
  • ADFIND.EXE
  • SHARPHOUND.EXE
• Amcache / ShimCache
• LDAP telemetry
• DC security logs
• EDR process lineage

MITRE ATT&CK References

• T1087.002 Domain Account Discovery
• T1482 Domain Trust Discovery
• T1069.002 Domain Groups
• T1018 Remote System Discovery

Decision Tree

1. Which AD recon tool executed?

   • Native binary
   • PowerShell
   • SharpHound / AdFind

2. Which targets queried?

   • Users
   • Groups
   • Trusts
   • SPNs

3. Which host initiated?

   • Admin host
   • Workstation
   • Server

4. Follow-up activity?

   • Kerberoasting
   • Lateral movement
   • Privilege escalation

5. Expand:

   • LDAP volume
   • DC connections
   • Additional recon

6. Scope:

   • Single query
   • Full graph collection
   • Campaign-wide recon

Example Detection Templates

KQL

SecurityEvent
| where EventID == 4688
| where NewProcessName has_any ("nltest.exe","net.exe","dsquery.exe","adfind.exe","SharpHound.exe")
| project TimeGenerated, Computer, Account, CommandLine

PowerShell
| where EventID == 4104
| where ScriptBlockText has_any ("Get-ADUser","Get-ADGroup","PowerView","Get-Domain")
| project TimeGenerated, Computer, ScriptBlockText

EQL

process where process.name in ("nltest.exe","dsquery.exe","adfind.exe","SharpHound.exe")

sequence by host.name with maxspan=5m
  [ process where process.name in ("SharpHound.exe","adfind.exe") ]
  [ network where destination.port in (389,636,88) ]

Sigma

title: Active Directory Enumeration Detection
id: 7a4d1c92-ad-enum
status: experimental
description: Detects common Active Directory reconnaissance activity
references:
  - https://attack.mitre.org/
author: Vergil
date: 2026-03-07
logsource:
  product: windows
  service: security
detection:
  selection:
    NewProcessName|endswith:
      - '\nltest.exe'
      - '\dsquery.exe'
      - '\adfind.exe'
      - '\SharpHound.exe'
  condition: selection
fields:
  - NewProcessName
  - CommandLine
falsepositives:
  - Legitimate administration
level: medium
tags:
  - attack.discovery

Sigma

index=main source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventID=1 earliest=1690447949 latest=1690450687 | search process_name IN (arp.exe,chcp.com,ipconfig.exe,net.exe,net1.exe,nltest.exe,ping.exe,systeminfo.exe,whoami.exe) OR (process_name IN (cmd.exe,powershell.exe) AND process IN (*arp*,*chcp*,*ipconfig*,*net*,*net1*,*nltest*,*ping*,*systeminfo*,*whoami*)) | stats values(process) as process, min(_time) as _time by parent_process, parent_process_id, dest, user | where mvcount(process) > 3

Mitigation & Hardening