Active Directory Computer Discovery and Export via PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects the use of the Get-ADComputer PowerShell cmdlet to enumerate computer information within an Active Directory environment and export the results to a file. This activity is often performed by adversaries during the discovery phase to map out the network.