Active Directory Structure Export Via Csvde.EXE

Rule Info

Tags
attack.exfiltration DEMO
Modified
None
Author
Nasreddine Bencherchali (Nextron Systems)
Name
Active Directory Structure Export Via Csvde.EXE
Description
Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.
Date
2023-03-14 00:00:00
Id
e5d36acd-acb4-4c6f-a13f-9eb203d50099
Type
Community Rule

Rule History

Commit
Date
Author
Title
2023-03-15
Nasreddine Bencherchali
fix: apply suggestions from code review
2023-03-14
Nasreddine Bencherchali
feat: new rules and update