Detect Domain Properties in Microsoft Sentinel
Adversaries may gather information about the victim's network domain(s) that can be used during targeting. Information about domains and their properties may include a variety of details, including what domain(s) the victim owns as well as administrative data (name, registrar, etc.) and more directly actionable information such as contacts, business addresses, and name servers. Adversaries gather this information via direct collection (WHOIS queries, DNS enumeration), passive data sets, or by querying publicly accessible API endpoints such as Microsoft's GetUserRealm and autodiscover APIs in Office 365/Azure environments. Tools such as AADInternals leverage these public APIs to enumerate tenant domain details, federation configuration, and company metadata — all without authenticating to the target environment.
MITRE ATT&CK
- Tactic
- Reconnaissance
- Technique
- T1590 Gather Victim Network Information
- Sub-technique
- T1590.001 Domain Properties
- Canonical reference
- https://attack.mitre.org/techniques/T1590/001/
KQL Detection Query
let AADReconPatterns = dynamic([
"Get-AADIntTenantDomains", "Get-AADIntLoginInformation", "Get-AADIntTenantDetails",
"Invoke-AADIntReconAsOutsider", "Get-AADIntCompanyInformation", "Get-AADIntTenantID",
"Get-AADIntOpenIDConfiguration", "Get-AADIntTenantDomainNames", "AADInternals"
]);
let WhoisToolPatterns = dynamic([
"whois.exe", "whois ", "Get-Whois", "Invoke-Whois"
]);
let WhoisServiceDomains = dynamic([
"whois.iana.org", "who.is", "whois.domaintools.com", "whois.verisign-grs.com",
"whois.networksolutions.com", "rdap.org", "rdap.arin.net", "rdap.verisign.com"
]);
// Detection 1: AADInternals module execution or O365 domain recon via PowerShell
let ToolExecution = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (AADReconPatterns)
or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has "GetUserRealm")
or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has "autodiscover" and ProcessCommandLine has "microsoft")
or ProcessCommandLine has_any (WhoisToolPatterns)
| extend DetectionType = case(
ProcessCommandLine has_any (AADReconPatterns), "AADInternals_DomainRecon",
ProcessCommandLine has "GetUserRealm", "O365_GetUserRealm_Recon",
ProcessCommandLine has "autodiscover", "Autodiscover_DomainEnum",
"WHOIS_Tool_Execution"
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
// Detection 2: WHOIS protocol connections (TCP port 43) or connections to known WHOIS web services
let WhoisConnections = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where (RemotePort == 43)
or (RemoteUrl has_any (WhoisServiceDomains))
| where InitiatingProcessFileName !in~ ("svchost.exe", "lsass.exe", "services.exe", "SearchProtocolHost.exe", "MsMpEng.exe")
| extend DetectionType = case(
RemotePort == 43, "WHOIS_Protocol_Port43",
"WHOIS_WebService_Access"
)
| project Timestamp, DeviceName,
AccountName=InitiatingProcessAccountName,
FileName=InitiatingProcessFileName,
ProcessCommandLine=InitiatingProcessCommandLine,
InitiatingProcessFileName,
RemoteUrl, RemoteIP, RemotePort, DetectionType;
// Detection 3: Azure AD audit events for domain enumeration operations
let AzureDomainEnum = AuditLogs
| where TimeGenerated > ago(24h)
| where OperationName in ("List domains", "Get domain", "Verify domain",
"List company information", "Get company information",
"List tenantDetails", "List organization")
| where Result == "success"
| extend InitiatedByUser = tostring(InitiatedBy.user.userPrincipalName)
| extend InitiatedByApp = tostring(InitiatedBy.app.displayName)
| extend IPAddress = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress)
| extend DetectionType = "AzureAD_DomainEnumeration"
| project Timestamp=TimeGenerated, DeviceName="AzureAD",
AccountName=coalesce(InitiatedByUser, InitiatedByApp),
FileName=InitiatedByApp, ProcessCommandLine=OperationName,
InitiatingProcessFileName=IPAddress, DetectionType;
union ToolExecution, WhoisConnections, AzureDomainEnum
| sort by Timestamp descDetects domain property reconnaissance using three complementary signals: (1) execution of AADInternals PowerShell module commands or direct O365 API recon patterns (GetUserRealm, autodiscover) captured via DeviceProcessEvents; (2) outbound network connections on TCP port 43 (WHOIS protocol) or to known WHOIS web services captured via DeviceNetworkEvents; (3) Azure AD audit log events for domain enumeration operations such as List domains and Get company information. The union of all three sources provides broad coverage across the pre-attack reconnaissance lifecycle.
Data Sources
Required Tables
False Positives & Tuning
- IT administrators performing legitimate WHOIS lookups to verify domain registrations, check expiry dates, or investigate abuse complaints
- Security teams using AADInternals or similar tools for authorized red team exercises, tenant health checks, or identity posture assessments
- DevOps/cloud automation scripts querying Azure AD domain configuration (List domains, List organization) during infrastructure provisioning or validation pipelines
- Third-party SaaS connectors and monitoring platforms that enumerate Azure AD tenant domain details during onboarding or health monitoring
- Domain registrars or managed DNS provider tools that perform routine WHOIS queries as part of domain portfolio management workflows
Other platforms for T1590.001
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1AADInternals Tenant Domain Reconnaissance
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Get-AADIntLoginInformation' and 'AADInternals'. PowerShell ScriptBlock Log Event ID 4104 with the full module import and command. Sysmon Event ID 3: Network connection from powershell.exe to login.microsoftonline.com (port 443). Azure AD Audit Logs may show GetUserRealm API access from the source IP.
- Test 2WHOIS Protocol Query via PowerShell
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'TcpClient' and 'whois.iana.org' and port 43. Sysmon Event ID 3: Network Connection from powershell.exe to whois.iana.org on DestinationPort 43. Security Event ID 4688 (if command line auditing enabled).
- Test 3Azure AD Domain List Enumeration via Graph API
Expected signal: Sysmon Event ID 1: Process Create for az.cmd or python.exe (Azure CLI) with CommandLine containing 'graph.microsoft.com' and 'domains'. Sysmon Event ID 3: Network connection from the Azure CLI process to graph.microsoft.com on port 443. Azure AD Audit Logs: OperationName='List domains' with the initiating user, IP address, and application 'Microsoft Azure CLI'.
- Test 4AADInternals External Tenant Reconnaissance (Outsider Mode)
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Invoke-AADIntReconAsOutsider' and 'AADInternals'. PowerShell ScriptBlock Log Event ID 4104 with the full function invocation. Multiple Sysmon Event ID 3 records: outbound HTTPS connections to login.microsoftonline.com, autodiscover.microsoft.com, and related Microsoft identity endpoints. Azure AD Audit Logs may record the GetUserRealm API calls with source IP.
- Test 5Bulk DNS Record Enumeration for Domain Mapping
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Resolve-DnsName' and multiple DNS record types. Sysmon Event ID 22 (DNS Query): multiple DNS queries for the target domain with QueryType values MX, NS, TXT, SOA. Windows DNS Client Event Log (Microsoft-Windows-DNS-Client/Operational): corresponding DNS resolution events.
References (11)
- https://attack.mitre.org/techniques/T1590/001/
- https://o365blog.com/post/just-looking/
- https://github.com/Gerenios/AADInternals
- https://who.is/
- https://dnsdumpster.com/
- https://www.circl.lu/services/passive-dns/
- https://docs.microsoft.com/en-us/archive/blogs/tip_of_the_day/cloud-tip-of-the-day-advanced-way-to-check-domain-availability-for-office-365-and-azure
- https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-audit-logs
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicenetworkevents-table
- https://unit42.paloaltonetworks.com/threat-assessment-sandworm-team/
- https://www.microsoft.com/en-us/security/blog/2021/03/02/new-nation-state-cyberattacks/
Unlock Pro Content
Get the full detection package for T1590.001 including response playbook, investigation guide, and atomic red team tests.