ADExplorer Writing Complete AD Snapshot Into .dat File
Detects the dual-use tool ADExplorer writing a complete Active Directory snapshot into a .dat file. This activity can be leveraged by attackers for various purposes, including data extraction for tools like Bloodhound, gathering usernames for password spraying attacks, or utilizing metadata for social engineering. While the snapshot typically does not contain password hashes, there have been instances where administrators inadvertently stored passwords in comment fields within Active Directory, which could then be exposed through such snapshots.
Sigma
