AdFind.exe Execution for Active Directory Reconnaissance
Detects the execution of the AdFind.exe utility, which is commonly used for reconnaissance in Active Directory environments. The rule identifies AdFind.exe by its image name, original filename, and specific IMPHASH values.
Sigma
