ADExplorer.exe Execution Followed by AD Snapshot (.dat) File Creation

Ibrahim Saud@tektrix

•updated Jul 2, 2026•1•0•6

This rule detects the execution of the AD Explorer tool followed by the creation of a .dat file within a 10-minute window. AD Explorer is a known administrative tool often used by adversaries for Active Directory reconnaissance, and creating or saving files with a .dat extension may indicate the export of captured AD data for further analysis or exfiltration.