UNC1549 AD Enumeration via ADExplorer Snapshot Creation

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•0

Detects the execution of Sysinternals ADExplorer. The rule specifically alerts when the utility is executed with the '-snapshot' flag and targets a file with a .dat extension, which is a technique used to perform unauthorized Active Directory enumeration and offline extraction of sensitive directory data.