ADExplorer execution and AD snapshot export for domain enumeration
Detects the use of the Sysinternals ADExplorer tool for Active Directory environment exploration, including the creation of snapshots or data dumps, as well as the use of the native 'net' utility to enumerate domain users and groups. These activities are common indicators of internal reconnaissance and discovery phases during an attack.
Splunk (SPL)
