User Discovery And Export Via Get-ADUser Cmdlet

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the use of the PowerShell Get-ADUser cmdlet to enumerate Active Directory user information and export it to a file or pipe it to other cmdlets for further processing, which can be indicative of reconnaissance or data staging by an attacker.