Active Directory Enumeration Tools Executed on Unmanaged Host
Detects the execution of known Active Directory enumeration tools such as AdFind and BloodHound/SharpHound, or manual net group domain queries, executed on hosts that may lack standard EDR instrumentation. This pattern is commonly associated with adversary lateral movement and reconnaissance in ransomware affiliate operations.
Sigma
