AD Explorer (ADExplorer64.exe) execution for AD reconnaissance
Detects the execution of ADExplorer64.exe, a legitimate but potentially misused Sysinternals tool often utilized by attackers for Active Directory reconnaissance and enumeration of domain objects.
Microsoft Sentinel (KQL)
