Backdoor.Turn Local Reconnaissance

Ibrahim Saud@tektrix

•updated Jun 18, 2026•2•0•5

Detects AD/LDAP reconnaissance commands executed by the Backdoor.Turn RAT, specifically when initiated by 'dbgview64.exe' and using commands like 'dsquery', 'nltest', 'csvde', or 'ldifde'.