Active Directory Structure Export Via Csvde.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•18

Detects the execution of "csvde.exe" with the '-f' flag, indicating an attempt to export the Active Directory structure. This tool is often used by adversaries for discovery and collection of domain account information.