Elastic low stable eql

Active Directory Discovery using AdExplorer

This rule detects the use of ADExplorer utility. Active Directory Explorer (AD Explorer) is an advanced Active Directory (AD) viewer and editor. AD Explorer also includes the ability to save snapshots of an AD database for off-line viewing and comparisons. Adversaries may abuse this utility to perform domain reconnaissance.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and
  (process.name : "ADExplorer*.exe" or ?process.pe.original_file_name == "AdExp")

Field Validations

Loading…

Comments (0)

Loading comments...