KESTREL: AD enumeration that doesn't announce itself

The tooling problem is embarrassing Everyone in AD security uses BloodHound. It's good at what it does, attack paths, delegation chains, ACL edges. No complaints there. The problem is the how. SharpHound is a .NET assembly. It floods your network with LDAP traffic patterns that zero legitimate workstations produce. EDR picks it up immediately, not because it's exploiting anything exotic, but because the behavioral signature is basically a neon sign. ADRecon, PowerView, Python alternatives, it's