Muddled Libra - AD Enumeration for SPN Hunting

Ethan Andrews@eandrews

•updated Feb 11, 2026•3•0•70

Detects the execution of Active Directory enumeration tools (ADRecon, ADExplorer) that result in the creation of 'ComputerSPNs.csv'. Muddled Libra uses this file to identify critical services (Veeam, MSSQL, Exchange) for targeting via their Service Principal Names (SPNs).