ADExplorer AD account/group enumeration and snapshot creation

Ibrahim Saud@tektrix

•updated Jul 2, 2026•2•0•4

Detects the use of ADExplorer with the snapshot command to create Active Directory database snapshots, or the usage of 'net user' and 'net group' commands with the /domain argument. These techniques are commonly used by attackers to enumerate Active Directory users and groups to identify high-value targets within a domain.