adconnectdump Extracts Entra Connect Credentials

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•1•0•9

Detects Python executing adconnectdump.py, which targets credentials stored by Microsoft Entra Connect. This tool is used to dump credentials from Microsoft Entra Connect (formerly Azure AD Connect) installations.