ADExplorer Snapshot Creation [snowflake-crowdstrikefdr_process]

Active Directory Explorer (AD Explorer) is a tool from the Sysinternals suite that allows users to view, search, and analyze objects within Active Directory, and it includes the capability to take snapshots of the AD database for offline analysis. A threat actor might leverage AD Explorer to gain detailed insights into the AD environment and use its snapshot capability to discreetly export and study the structure, user accounts, and security settings, potentially identifying vectors for privilege escalation or lateral movement within a network. This use case detects executions of ADExplorer with the snapshot command.