PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE — Detection Rule

Detects active directory enumeration activity using known AdFind CLI flags

Read the full analysis on IntelFusions