Suspicious Active Directory Database Snapshot Via ADExplorer
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag to save a local copy of the Active Directory database. This activity is suspicious as it can be used by attackers to extract data for Bloodhound, gather usernames for password spraying, or obtain metadata for social engineering. While the snapshot typically doesn't contain password hashes, administrators sometimes store passwords in comment fields, which could be exposed.
Sigma
