Active Directory Reconnaissance with dsquery
Detects the use of 'dsquery.exe' to perform broad Active Directory user reconnaissance. Threat actors like UAT-8837 use this legitimate tool to enumerate all users in a domain to identify high-value targets.
Sigma
