Active Directory Enumeration via SysInternals ADExplorer Snapshot

Ibrahim Saud@tektrix

•updated Jul 2, 2026•3•0•8

Detects the execution of ADExplorer.exe, a legitimate administrative tool often abused by attackers to export Active Directory data. The rule specifically flags instances where the command line arguments include '-snapshot' or specify a '.dat' output file, which are strong indicators of unauthorized Active Directory data extraction or staging for offline analysis.