PowerShell ActiveDirectory module
Named by 2 kept items in this workspace.
1 items name it under affected products and 1 under tools.
Search every workspace for PowerShell ActiveDirectory module. It matches the name as written, so it can find other things that share it.
The items that name it 2
Get-ADComputer, Get-ADUser, Get-ADGroup cmdlets use ADWS rather than direct LDAP, evading LDAP-based detections
Native Windows tool using wldap32.dll, generates Event 30 logs for correlation with Event 1644
All technologies in this workspace.