User Discovery And Export Via Get-ADUser Cmdlet - PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file. This activity is often associated with reconnaissance phases where attackers enumerate Active Directory users for further targeting.