Bulk AD user enumeration via Get-ADUser wildcard filter and CSV export

Luís Marques@remotecodeexecution

•updated Jul 14, 2026•2•0•2

Detects unauthorized attempts to perform bulk enumeration of Active Directory user objects by monitoring for Get-ADUser cmdlet execution with wildcard filters. Additionally, it monitors for the creation of common output files (e.g., CSV exports) often used to store the results of such reconnaissance activities.