PUA - AdFind Suspicious Execution

Hunt Hypothesis

Detects AdFind execution with common flags seen used during attacks

Detection Rule

Sigma (Original)

title: PUA - AdFind Suspicious Execution
id: 9a132afa-654e-11eb-ae93-0242ac130002
related:
    - id: 455b9d50-15a1-4b99-853f-8d37655a4c1b
      type: similar
    - id: 75df3b17-8bcc-4565-b89b-c9898acef911
      type: obsolete
status: test
description: Detects AdFind execution with common flags seen used during attacks
references:
    - https://www.joeware.net/freetools/tools/adfind/
    - https://thedfirreport.com/2020/05/08/adfind-recon/
    - https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/
    - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
    - https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
    - https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md
    - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1087.002/T1087.002.md#atomic-test-7---adfind---enumerate-active-directory-user-objects
author: Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community
date: 2021-02-02
modified: 2025-10-24
tags:
    - attack.discovery
    - attack.t1018
    - attack.t1087.002
    - attack.t1482
    - attack.t1069.002
    - stp.1u
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'domainlist'
            - 'trustdmp'
            - 'dcmodes'
            - 'adinfo'
            - '-sc dclist'
            - 'computer_pwdnotreqd'
            - 'objectcategory='
            - '-subnets -f'
            - 'name="Domain Admins"'
            - '-sc u:'
            - 'domainncs'
            - 'dompol'
            - ' oudmp '
            - 'subnetdmp'
            - 'gpodmp'
            - 'fspdmp'
            - 'users_noexpire'
            - 'computers_active'
            - 'computers_pwdnotreqd'
    condition: selection
falsepositives:
    - Legitimate admin activity
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage/info.yml
simulation:
    - type: atomic-red-team
      name: Adfind - Enumerate Active Directory Computer Objects
      technique: T1018
      atomic_guid: a889f5be-2d54-4050-bd05-884578748bb4
    - type: atomic-red-team
      name: Adfind - Enumerate Active Directory Domain Controller Objects
      technique: T1018
      atomic_guid: 5838c31e-a0e2-4b9f-b60a-d79d2cb7995e

KQL (Azure Sentinel)

imProcessCreate
| where TargetProcessCommandLine contains "domainlist" or TargetProcessCommandLine contains "trustdmp" or TargetProcessCommandLine contains "dcmodes" or TargetProcessCommandLine contains "adinfo" or TargetProcessCommandLine contains "-sc dclist" or TargetProcessCommandLine contains "computer_pwdnotreqd" or TargetProcessCommandLine contains "objectcategory=" or TargetProcessCommandLine contains "-subnets -f" or TargetProcessCommandLine contains "name=\"Domain Admins\"" or TargetProcessCommandLine contains "-sc u:" or TargetProcessCommandLine contains "domainncs" or TargetProcessCommandLine contains "dompol" or TargetProcessCommandLine contains " oudmp " or TargetProcessCommandLine contains "subnetdmp" or TargetProcessCommandLine contains "gpodmp" or TargetProcessCommandLine contains "fspdmp" or TargetProcessCommandLine contains "users_noexpire" or TargetProcessCommandLine contains "computers_active" or TargetProcessCommandLine contains "computers_pwdnotreqd"

Required Data Sources

False Positive Guidance

• Legitimate admin activity

MITRE ATT&CK Context

• Tactic: Discovery
• Technique: T1018 — T1018
• Technique: T1087.002 — T1087.002
• Technique: T1482 — T1482
• Technique: T1069.002 — T1069.002

References

• https://www.joeware.net/freetools/tools/adfind/
• https://thedfirreport.com/2020/05/08/adfind-recon/
• https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/
• https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
• https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
• https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md
• https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1087.002/T1087.002.md#atomic-test-7---adfind---enumerate-active-directory-user-objects
• SigmaHQ Rule