Suspicious Active Directory Database Snapshot Through ADExplorer - High Confidence (via process_creation)

This rule detects the execution of Sysinternals ADExplorer with the "-snapshot" flag to save a local copy of the active directory database to an anomalous directory. This can be used by adversaries to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.