Bulk AD computer enumeration via Get-ADComputer wildcard filter export

Luís Marques@remotecodeexecution

•updated Jul 14, 2026•0•0•0

Detects the use of PowerShell Get-ADComputer cmdlet with wildcard filters combined with parameters like -Server or -Properties, or redirects to CSV files. This pattern is indicative of unauthorized discovery of domain computer objects.