Active Directory Database Snapshot Via ADExplorer
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag to create a local copy of the Active Directory database. This activity can be used by attackers for various purposes, including extracting data for Bloodhound, gathering usernames for password spraying, or leveraging metadata for social engineering. While the snapshot does not contain password hashes, administrators sometimes store passwords in comment fields, which could be exposed.
Sigma
