DirectorySearcher Powershell Exploitation — Detection Rule

Enumerates Active Directory to determine computers that are joined to the domain

Read the full analysis on IntelFusions