Merge PR #5186 from @swachchhanda000 - Increase coverage of AADinternals rules

update: AADInternals PowerShell Cmdlets Execution - PsScript - Add additional strings from the AADinternals framework
update: AADInternals PowerShell Cmdlets Execution - ProccessCreation - Add additional strings from the AADinternals framework

rules/windows/powershell/powershell_script/posh_ps_aadinternals_cmdlets_execution.yml

@@ -8,8 +8,9 @@ description: Detects ADDInternals Cmdlet execution. A tool for administering Azu
 references:
     - https://o365blog.com/aadinternals/
     - https://github.com/Gerenios/AADInternals
-author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems)
+author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
 date: 2022-12-23
+modified: 2025-02-06
 tags:
     - attack.execution
     - attack.reconnaissance
@@ -29,8 +30,10 @@ detection:
             - 'Disable-AADInt'
             - 'Enable-AADInt'
             - 'Export-AADInt'
+            - 'Find-AADInt'
             - 'Get-AADInt'
             - 'Grant-AADInt'
+            - 'Initialize-AADInt'
             - 'Install-AADInt'
             - 'Invoke-AADInt'
             - 'Join-AADInt'
@@ -39,11 +42,15 @@ detection:
             - 'Read-AADInt'
             - 'Register-AADInt'
             - 'Remove-AADInt'
+            - 'Reset-AADInt'
+            - 'Resolve-AADInt'
             - 'Restore-AADInt'
+            - 'Save-AADInt'
             - 'Search-AADInt'
             - 'Send-AADInt'
             - 'Set-AADInt'
             - 'Start-AADInt'
+            - 'Unprotect-AADInt'
             - 'Update-AADInt'
     condition: selection
 falsepositives: