{"id":"9212f354-7775-4e28-9c9f-8f0a4544e664","title":"Active Directory Database Snapshot Via ADExplorer","description":"Detects the execution of Sysinternals ADExplorer with the \"-snapshot\" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-03-14","modified":"2025-07-09","tags":["attack.discovery","attack.t1087.002","attack.t1069.002","attack.t1482"],"technique_ids":["T1069.002","T1087.002","T1482"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html","https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer","https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24","https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/","https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/","https://trustedsec.com/blog/adexplorer-on-engagements"],"source_path":"rules/windows/process_creation/proc_creation_win_sysinternals_adexplorer_execution.yml","source_sha256":"b78105dfb3e3ab4cec97543fe5b9c770991b126378cbb6cc5c69023f27a8f2ba","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_sysinternals_adexplorer_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Active Directory Database Snapshot Via ADExplorer\nid: 9212f354-7775-4e28-9c9f-8f0a4544e664\nrelated:\n    - id: ef61af62-bc74-4f58-b49b-626448227652\n      type: derived\nstatus: test\ndescription: Detects the execution of Sysinternals ADExplorer with the \"-snapshot\" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.\nreferences:\n    - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html\n    - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer\n    - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24\n    - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/\n    - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/\n    - https://trustedsec.com/blog/adexplorer-on-engagements\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-03-14\nmodified: 2025-07-09\ntags:\n    - attack.discovery\n    - attack.t1087.002\n    - attack.t1069.002\n    - attack.t1482\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\ADExp.exe'\n              - '\\ADExplorer.exe'\n              - '\\ADExplorer64.exe'\n              - '\\ADExplorer64a.exe'\n        - OriginalFileName: 'AdExp'\n        - Description: 'Active Directory Editor'\n        - Product: 'Sysinternals ADExplorer'\n    selection_cli:\n        CommandLine|contains: 'snapshot'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1069.002","id":"T1069.002","name":"Domain Groups","page":"techniques/enterprise/T1069.002/"},{"key":"enterprise/T1087.002","id":"T1087.002","name":"Domain Account","page":"techniques/enterprise/T1087.002/"},{"key":"enterprise/T1482","id":"T1482","name":"Domain Trust Discovery","page":"techniques/enterprise/T1482/"}],"data_path":"data/detection-rules/9212f354-7775-4e28-9c9f-8f0a4544e664.json","kind":"sigma"}