PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE

SigmaHQ Detections@sigmaHQ

•updated Nov 26, 2025•0•0•1

Detects active directory enumeration activity using known AdFind CLI flags