UNC1549 ADExplorer AD Snapshot Collection
Detects the execution of ADExplorer.exe with the command-line arguments to perform a snapshot export. AD Explorer is a legitimate administrative tool often abused by adversaries to perform offline NTDS.dit extraction or to enumerate Active Directory objects.
Microsoft Sentinel (KQL)
