Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Pysa – ADRecon Active Directory Enumeration Sweep

Pysa Discovery Sentinel
MITRE ATT&CK
Domain Account
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (pysa)
What This Detects
Separately from its SessionGopher/Empire-Koadic credential-and-C2 chain, Pysa runs the ADRecon PowerShell tool for bulk Active Directory enumeration (users, groups, trusts, GPOs) in a single pass.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has "ADRecon" or FileName has "adrecon"
| project Timestamp, DeviceName, ProcessCommandLine, AccountName

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.