Security teams can detect dsquery activity by watching for Active Directory enumeration from endpoints that do not normally perform directory administration. Focus on repeated queries for users, groups, computers, or group memberships, especially when followed by privilege escalation or lateral movement. Correlate with account role, source host, and command-line pattern.
What dsquery activity looks like in endpoint telemetry
dsquery is not inherently malicious. It becomes interesting when it appears on user workstations, jump hosts, or server roles that do not normally perform directory administration, especially outside approved admin workflows. The most useful signal is the pattern of enumeration: searches for users, groups, computers, or group memberships, often in bursts, often followed by other discovery or privilege activity.
Look at the command context, not just the process name. A benign administrative script, an IT support session, and an intruder doing reconnaissance can all launch the same binary. The difference is usually in the host role, the account used, the timing, and whether dsquery is part of a broader sequence that ends in privilege escalation or lateral movement.
Because dsquery is part of living-off-the-land behavior, detection improves when you baseline legitimate directory administration and then flag outliers. The same approach works for other built-in Windows utilities used for discovery, so this should sit alongside your broader monitoring for dual-use administrative tooling and command-line abuse. Living off the Land Guide
How to separate normal directory administration from suspicious enumeration
The strongest discriminator is expected business use. Domain admin work, provisioning, and scheduled inventory tasks can produce directory queries, but they usually come from known admin hosts, known service accounts, and predictable scripts. Suspicious use tends to come from endpoints that should not be doing AD discovery at all, or from accounts with no operational need to enumerate directory structure.
Command-line patterns matter. Repeated queries for the same object classes, broad searches across multiple groups or computers, and chained lookups that build a picture of the domain are more concerning than a one-off lookup. If you can correlate that activity with a newly compromised host, a helpdesk account, or a non-admin logon session, the signal becomes much stronger.
Enrichment should focus on whether the source system is allowed to act like an admin workstation. If the endpoint is not in the approved management set, dsquery may be an early sign of internal reconnaissance rather than routine administration. Map that activity to adversary tradecraft for discovery, credential access, and follow-on movement. MITRE ATT&CK Enterprise Matrix
Telemetry that improves detection fidelity
Command-line logging is the starting point, but it should not be the only control. Pair process creation data with host identity, user role, and parent process lineage so you can distinguish an interactive admin session from scripted abuse. Network and authentication telemetry can add context when dsquery is followed by LDAP queries, remote logons, or suspicious use of privileged accounts.
Detection quality improves when you correlate dsquery with nearby indicators such as group membership enumeration, domain controller access, and subsequent remote execution. That sequencing is often more valuable than the binary itself, because attackers rarely stop at discovery. They use directory visibility to choose targets, confirm privilege paths, and move laterally with less noise.
When you tune detections, treat endpoint role as a first-class variable. A command that is expected on a dedicated admin host can be high confidence on a finance laptop or engineering workstation. The same logic should feed alert suppression, because overly broad alerting on every directory query quickly erodes analyst trust.
Risk and Threat Considerations
dsquery is attractive to attackers because it is low-noise, built into Windows environments, and useful for mapping users, groups, and computers before deeper compromise. The risk increases when directory enumeration appears on non-admin endpoints or is followed by privilege escalation, because that sequence often indicates an intruder is building an internal attack path.
Failure mechanism: Defenders miss the activity when they focus on the binary alone and do not tie it to host role, account context, and follow-on behavior. The result is a normal-looking discovery command blending into everyday administration while an adversary uses it to identify targets, privileges, and lateral movement options.
Impact: Earlier-stage compromise can persist longer, privileged accounts can be identified faster, and containment becomes harder because the attacker has already mapped the directory. In practice, missed dsquery activity often weakens the ability to detect reconnaissance before the environment is used for escalation or spread.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1087 — Account Discovery | dsquery is used to enumerate users and groups, which maps directly to account discovery. |
| Recommendation — Alert on directory enumeration from non-admin hosts and correlate it with later privilege and movement activity. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Detecting dsquery depends on collecting and reviewing process and command-line audit telemetry. |
| Recommendation — Centralize endpoint command-line logs and review them for directory enumeration outliers. | ||
| NIST CSF 2.0 | DE.CM-01 — Anomalies and events are monitored to find potential cybersecurity events | This use case is anomaly monitoring for suspicious administrative tooling on unexpected endpoints. |
| Recommendation — Monitor for dsquery on hosts and accounts that do not normally perform directory administration. | ||
Practitioner Guidance
What to verify: Confirm which hosts are allowed to run directory enumeration, which accounts are allowed to do it, and whether the command source matches that expectation. If the endpoint is not an admin workstation, raise the priority of the alert even if the query itself looks routine.
What to measure: Track how often dsquery appears outside approved management systems, and whether those events cluster around unusual logon sessions, new admin group memberships, or remote execution. A small number of high-context alerts is more useful than a large number of low-fidelity detections.
Practitioner takeaway: Detecting dsquery is mostly about context, not syntax. The best alerts combine process telemetry with workstation role, account privilege, and follow-on activity so legitimate administration stays quiet while reconnaissance stands out.