AD Enumeration via net group, net user /domain, or ADExplorer on Unexpected Host

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•5

Detects the use of native Windows commands 'net.exe' and 'net1.exe' to perform domain group or user enumeration, as well as the execution of 'ADExplorer.exe' (a known tool for viewing and editing Active Directory objects). These activities are commonly associated with the reconnaissance phase of an attack to map network infrastructure and identify privileged accounts.