AdsiSearcher Account Discovery via PowerShell

The analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for domain users. It identifies script blocks containing `[adsisearcher]`, `objectcategory=user`, and `.findAll()` from PowerShell Script Block Logging (EventCode=4104). This activity may indicate an attempt by adversaries or Red Teams to enumerate domain users for situational awareness and Active Directory discovery, potentially leading to further reconnaissance, privilege escalation, or lateral movement.