Domain group enumeration via net group or the AD cmdlets

Siemphony@siemphonylowT1069.002verified in lab

Matches the Windows leg of AN1025: a process-creation event where net.exe or its net1.exe helper is invoked with the group verb against a domain, or where the command line carries one of the directory-reading cmdlets and utilities that return domain group objects. The net arm requires both ` group ` and `/domain` on the same command line, which keeps the rule on the domain side of the T1069.001/T1069.002 split — ` localgroup` never contains ` group ` with a leading space, and the published T1069.001 rule owns that half. The cmdlet and utility names below are authored here, not supplied by MITRE; the analytic gives only the knobs. What the analytic actually asks for is a chain — enumeration followed by LSASS or API access within a window — and lib/sigma models no timeframe, no aggregation and no identity lookup, so MITRE's TimeWindow, UserContext and ProcessLineageDepth knobs are all unexpressible and a match means one enumeration command ran and nothing more. Three coverage limits are structural: the LDAP and ADSI routes that read the same groups without a new process leave nothing on this logsource, a PowerView cmdlet typed into an already-running session never reaches CommandLine at all, and base64-encoded PowerShell hides the cmdlet name. The brief maps Security EventID 4688 onto the Sysmon-shaped process_creation category; this rule is written in the Sysmon EventID 1 vocabulary (Image, CommandLine), so an estate feeding 4688 into that category must map NewProcessName onto Image first, and must have both Audit Process Creation and the separate Include command line in process creation events policy enabled — neither is on by default, and without the second one CommandLine is empty and every selection here is dead. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0360, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "\\net.exe" or FolderPath endswith "\\net1.exe") and (ProcessCommandLine contains " group " and ProcessCommandLine contains "/domain")) or (ProcessCommandLine contains "Get-ADGroup" or ProcessCommandLine contains "Get-ADPrincipalGroupMembership" or ProcessCommandLine contains "Get-DomainGroup" or ProcessCommandLine contains "Get-NetGroup" or ProcessCommandLine contains "dsquery group" or ProcessCommandLine contains "dsget group"))

Splunk · SPL

Run this as a search.

index=* (((Image="*\\net.exe" OR Image="*\\net1.exe") AND (CommandLine="* group *" AND CommandLine="*/domain*")) OR (CommandLine="*Get-ADGroup*" OR CommandLine="*Get-ADPrincipalGroupMembership*" OR CommandLine="*Get-DomainGroup*" OR CommandLine="*Get-NetGroup*" OR CommandLine="*dsquery group*" OR CommandLine="*dsget group*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\net.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net1.exe") AND (TO_LOWER(process.command_line) LIKE "* group *" AND TO_LOWER(process.command_line) LIKE "*/domain*")) OR (TO_LOWER(process.command_line) LIKE "*get-adgroup*" OR TO_LOWER(process.command_line) LIKE "*get-adprincipalgroupmembership*" OR TO_LOWER(process.command_line) LIKE "*get-domaingroup*" OR TO_LOWER(process.command_line) LIKE "*get-netgroup*" OR TO_LOWER(process.command_line) LIKE "*dsquery group*" OR TO_LOWER(process.command_line) LIKE "*dsget group*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\net\.exe$|\\net1\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(?=.*(?: group ))(?=.*(?:/domain)).*</field>    <description>Domain group enumeration via net group or the AD cmdlets (1/2)</description>    <mitre>      <id>T1069.002</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Get-ADGroup|Get-ADPrincipalGroupMembership|Get-DomainGroup|Get-NetGroup|dsquery group|dsget group)</field>    <description>Domain group enumeration via net group or the AD cmdlets (2/2)</description>    <mitre>      <id>T1069.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 21aae1ac-7621-44d5-9042-ad99235d7274

ATT&CKT1069.002

T1069.002Domain Groups

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

A process-creation event asking the directory which domain groups exist and who belongs to them — net group ... /domain, or one of the AD and offensive PowerShell cmdlets that return domain group objects. This is the Windows leg of AN1025. The domain qualifier is what separates the rule from its sibling: the published T1069.001 rule owns local group enumeration, and this one is constructed so the two do not overlap.

02 · Telemetry you need

category: process_creation, product: windows, copied from the brief. The rule is written in the Sysmon EventID 1 vocabulary (Image, CommandLine). The brief maps Security EventID 4688 onto this same Sysmon-shaped category, so an estate on 4688 must map NewProcessName onto Image first — and must have Audit Process Creation enabled plus the separate Include command line in process creation events policy. Neither is on by default or in the MS/CIS baselines, and without the second one CommandLine is empty, every selection is dead, and the rule returns zero rows while looking perfectly healthy. The brief's second log source, PowerShell 4103/4104, is not used by this rule.

03 · How the logic works

Condition: (selection_net_image and selection_net_verb) or selection_cmdlet. The net arm requires Image|endswith on \net.exe or \net1.exe, plus CommandLine|contains|all of ' group ' and '/domain'. Both substrings on the same command line is the domain gate. Note the spaces around ' group ' — localgroup never contains a leading-space group, so the local sibling cannot leak in here, and the /domain requirement means a bare net group against the local machine is also excluded. The cmdlet arm is a single CommandLine|contains list: Get-ADGroup (which also catches Get-ADGroupMember), Get-ADPrincipalGroupMembership, Get-DomainGroup and Get-NetGroup from PowerView, plus dsquery group and dsget group. Those names are authored by this pipeline; MITRE supplies only the knobs. And the knobs are the point of the gap — AN1025 asks for enumeration followed by LSASS or API access within a window, and MITRE's TimeWindow, UserContext and ProcessLineageDepth are all unexpressible in this Sigma dialect, which models no timeframe, no aggregation and no identity lookup. A match means one command ran. Three blind spots follow: LDAP and ADSI read the same groups without spawning a process, a PowerView cmdlet typed into an already-running session never reaches CommandLine, and base64-encoded PowerShell hides the cmdlet name.

04 · Common false positives

Very. Get-ADGroup and Get-ADGroupMember are simply how anyone answers a question about AD groups, so scheduled membership reports, identity-governance sync jobs, access-review exports and every admin session on a domain controller or RSAT-equipped host match. That is the dominant source and the reason the rule is low. Logon and provisioning scripts branch on group membership with net group /domain or Get-ADPrincipalGroupMembership once per session per workstation. Credentialed compliance scanners enumerate privileged groups on a fixed schedule, producing identical command lines daily. Helpdesk staff run net group /domain and dsquery group before escalating tickets.

05 · Detection maturity

tier_1: Lowest tier. Derived from MITRE prose and never run against a log line — the cmdlet list, the noise ordering and the low level are all unvalidated reasoning. Hunt with it, measure, then decide.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Scope before you exclude. Drop domain controllers and admin jump hosts out of scope entirely, then suppress your scanner and IGA service accounts by name. After that, the useful signal is context the rule cannot express: alert only when the caller is a non-admin or a workstation service account (MITRE's UserContext knob), or when a second discovery or credential-access event follows on the same host within minutes (TimeWindow). Both belong in a correlation layer above this rule.

Declared by the author

Identity and directory administration. Get-ADGroup and Get-ADGroupMember are the ordinary way to answer any question about AD groups, so scheduled group-membership reports, HR and identity-governance sync jobs, access-review exports and admin sessions on any host with RSAT or on a domain controller produce a steady stream of matches — the highest-volume source by a wide margin, and the reason this rule is scored low rather than medium.
Logon and provisioning scripts that branch on domain group membership, typically with a net group /domain call naming Domain Admins, or with Get-ADPrincipalGroupMembership, to decide which drives to map, which printers to install or which software to deploy. These run once per user session on every workstation.
Compliance and vulnerability scanners with credentialed checks that enumerate privileged domain groups on a fixed schedule to report who holds Domain Admin, producing identical command lines from the scanner's service account at the same time every day.
Helpdesk and desktop-support work, where net group /domain and dsquery group are the standard way to confirm whether a user is in the right group before escalating a ticket.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — Domain group discovery
passed
Siemphony IR · 3 Sept 2026
10 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1069.002, evaluated against their process_creation events.

Share this rule

/u/siemphony/21aae1ac-7621-44d5-9042-ad99235d7274

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Domain group enumeration via net group or the AD cmdlets

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it