Anvilogic high experimental spl
ADExplorer Execution [splunk-sysmon]
Active Directory Explorer (AD Explorer) is a tool from the Sysinternals suite that allows users to view, search, and analyze objects within Active Directory to understand its structure, object properties, and security settings. A threat actor might leverage AD Explorer to gain detailed insights into the AD environment, such as identifying privileged user accounts and network resources, which can be exploited to escalate privileges or facilitate lateral movement within a network. This use case detects executions of ADExplorer .
Detection Logic
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1)
OR "<EventID>1<") "ADExplorer64.exe"
OR "ADExplorer.exe"
OR "ADExplorer"
OR "AdExp"
| regex process_name="(?i)ADExplorer(64)?
| AdExp\.exe"
| table _time, host, user, parent_process_name, process, process_*
| bin span=1s
| stats values(*) as * by _time, hostField Validations
Loading…
Comments (0)
Loading comments...