PowerShell AD Enumeration: Get-ADComputer/User Export to ProgramData CSV

Duo Tech@duotech

•updated Jun 29, 2026•21•0•9

Detects suspicious PowerShell activity using Active Directory enumeration cmdlets (e.g., Get-ADUser, Get-ADComputer, Get-DnsServerZone) that outputs results into CSV or text files within the C:\ProgramData directory. This pattern is commonly used during reconnaissance and staging for data exfiltration by threat actors.