{"id":"0a1255c5-d732-4b62-ac02-b5152d34fb83","title":"ADExplorer Writing Complete AD Snapshot Into .dat File","description":"Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.","author":"Arnim Rupp (Nextron Systems), Thomas Patzke","status":"experimental","level":"medium","date":"2025-07-09","modified":"","tags":["attack.discovery","attack.t1087.002","attack.t1069.002","attack.t1482"],"technique_ids":["T1069.002","T1087.002","T1482"],"logsource":{"category":"file_event","product":"windows"},"falsepositives":["Legitimate use of ADExplorer by administrators creating .dat snapshots"],"references":["https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer","https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24","https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/","https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/","https://trustedsec.com/blog/adexplorer-on-engagements"],"source_path":"rules/windows/file/file_event/file_event_win_sysinternals_adexplorer_dump_written.yml","source_sha256":"5d9b565e2823e564dec50db4a1658f45ad6c2094e61f72bd9c80de84d9c74521","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_sysinternals_adexplorer_dump_written.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: ADExplorer Writing Complete AD Snapshot Into .dat File\nid: 0a1255c5-d732-4b62-ac02-b5152d34fb83\nrelated:\n    - id: 9212f354-7775-4e28-9c9f-8f0a4544e664\n      type: similar\nstatus: experimental\ndescription: Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.\nreferences:\n    - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer\n    - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24\n    - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/\n    - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/\n    - https://trustedsec.com/blog/adexplorer-on-engagements\nauthor: Arnim Rupp (Nextron Systems), Thomas Patzke\ndate: 2025-07-09\ntags:\n    - attack.discovery\n    - attack.t1087.002\n    - attack.t1069.002\n    - attack.t1482\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection:\n        Image|endswith:\n            - '\\ADExp.exe'\n            - '\\ADExplorer.exe'\n            - '\\ADExplorer64.exe'\n            - '\\ADExplorer64a.exe'\n        TargetFilename|endswith: '.dat'\n    condition: selection\nfalsepositives:\n    - Legitimate use of ADExplorer by administrators creating .dat snapshots\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1069.002","id":"T1069.002","name":"Domain Groups","page":"techniques/enterprise/T1069.002/"},{"key":"enterprise/T1087.002","id":"T1087.002","name":"Domain Account","page":"techniques/enterprise/T1087.002/"},{"key":"enterprise/T1482","id":"T1482","name":"Domain Trust Discovery","page":"techniques/enterprise/T1482/"}],"data_path":"data/detection-rules/0a1255c5-d732-4b62-ac02-b5152d34fb83.json","kind":"sigma"}