Suspicious Get-ADDBAccount Usage

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get access to credentials without using any credential dumpers