Active Directory Enumeration Using dsquery
Detects the use of dsquery.exe to enumerate users in Active Directory. This command-line utility is often used by attackers for reconnaissance to gather information about domain users.
Microsoft Sentinel (KQL)
