Mass AD enumeration via ActiveDirectory PowerShell module cmdlets with -Filter *
Detects anomalous, high-frequency usage of Active Directory PowerShell cmdlets (e.g., Get-ADUser, Get-ADGroup) by a single user or process within a short timeframe, which is a common indicator of internal domain reconnaissance by an adversary.
Microsoft Sentinel (KQL)
