Domain Admin Enumeration

This query will detect Domain Admin Enumeration based on the Microsoft Defender for Identity Module

CQL · Falcon Next-Gen SIEMCopy query

#Vendor="microsoft"
| #event.dataset = "defender-identity.IdentityQueryEvents"
| Vendor.properties.QueryType ="AllDomainAdminsOrEnterpriseAdmins"
| table([@timestamp,host.name,destination.address,Vendor.properties.Query,Vendor.properties.AdditionalFields.SearchFilter,Vendor.properties.AdditionalFields.LdapSearchScope])

This query will detect Domain Admin enumeration based on the Microsoft defender for Identity log sources.

domain_admin_enumeration.yml

T1069.002

Kundan Kumar

Detection

Identity

2026-05-08

Domain Admin Enumeration

Get this query running in your SIEM, with someone on call.