ADExplorer Active Directory Snapshot Enumeration

Ibrahim Saud@tektrix

•updated Jul 2, 2026•7•0•7

Detects execution and file activity associated with Sysinternals AD Explorer, a tool often used by adversaries to enumerate Active Directory environments and perform snapshots.