AD Replication Subnet Enumeration via Get-ADReplicationSubnet
Detects attempts to enumerate Active Directory replication subnets using the Get-ADReplicationSubnet cmdlet. This technique is often employed by attackers to gather information about the network topology and potential targets within a domain.
Sigma

