AD replication subnet enumeration via Get-ADReplicationSubnet

Luís Marques@remotecodeexecution

•updated Jul 14, 2026•0•0•1

Detects the use of the Get-ADReplicationSubnet PowerShell cmdlet to query Active Directory replication subnet configurations. Attackers may use this command to map the internal network topology, identify domain controllers, and scope lateral movement targets within the AD environment.