{"id":"9a132afa-654e-11eb-ae93-0242ac130002","title":"PUA - AdFind Suspicious Execution","description":"Detects AdFind execution with common flags seen used during attacks","author":"Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community","status":"test","level":"high","date":"2021-02-02","modified":"2025-10-24","tags":["attack.discovery","attack.t1018","attack.t1087.002","attack.t1482","attack.t1069.002","stp.1u"],"technique_ids":["T1018","T1069.002","T1087.002","T1482"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate admin activity"],"references":["https://www.joeware.net/freetools/tools/adfind/","https://thedfirreport.com/2020/05/08/adfind-recon/","https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/","https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/","https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx","https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md","https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1087.002/T1087.002.md#atomic-test-7---adfind---enumerate-active-directory-user-objects"],"source_path":"rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage.yml","source_sha256":"52d4dcc47c3a9ef607281ac874d6068aced8c5e1a7650a2fa76bc6875e13372c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PUA - AdFind Suspicious Execution\nid: 9a132afa-654e-11eb-ae93-0242ac130002\nrelated:\n    - id: 455b9d50-15a1-4b99-853f-8d37655a4c1b\n      type: similar\n    - id: 75df3b17-8bcc-4565-b89b-c9898acef911\n      type: obsolete\nstatus: test\ndescription: Detects AdFind execution with common flags seen used during attacks\nreferences:\n    - https://www.joeware.net/freetools/tools/adfind/\n    - https://thedfirreport.com/2020/05/08/adfind-recon/\n    - https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/\n    - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/\n    - https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx\n    - https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md\n    - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1087.002/T1087.002.md#atomic-test-7---adfind---enumerate-active-directory-user-objects\nauthor: Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community\ndate: 2021-02-02\nmodified: 2025-10-24\ntags:\n    - attack.discovery\n    - attack.t1018\n    - attack.t1087.002\n    - attack.t1482\n    - attack.t1069.002\n    - stp.1u\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains:\n            - 'domainlist'\n            - 'trustdmp'\n            - 'dcmodes'\n            - 'adinfo'\n            - '-sc dclist'\n            - 'computer_pwdnotreqd'\n            - 'objectcategory='\n            - '-subnets -f'\n            - 'name=\"Domain Admins\"'\n            - '-sc u:'\n            - 'domainncs'\n            - 'dompol'\n            - ' oudmp '\n            - 'subnetdmp'\n            - 'gpodmp'\n            - 'fspdmp'\n            - 'users_noexpire'\n            - 'computers_active'\n            - 'computers_pwdnotreqd'\n    condition: selection\nfalsepositives:\n    - Legitimate admin activity\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: Adfind - Enumerate Active Directory Computer Objects\n      technique: T1018\n      atomic_guid: a889f5be-2d54-4050-bd05-884578748bb4\n    - type: atomic-red-team\n      name: Adfind - Enumerate Active Directory Domain Controller Objects\n      technique: T1018\n      atomic_guid: 5838c31e-a0e2-4b9f-b60a-d79d2cb7995e\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1018","id":"T1018","name":"Remote System Discovery","page":"techniques/enterprise/T1018/"},{"key":"enterprise/T1069.002","id":"T1069.002","name":"Domain Groups","page":"techniques/enterprise/T1069.002/"},{"key":"enterprise/T1087.002","id":"T1087.002","name":"Domain Account","page":"techniques/enterprise/T1087.002/"},{"key":"enterprise/T1482","id":"T1482","name":"Domain Trust Discovery","page":"techniques/enterprise/T1482/"}],"data_path":"data/detection-rules/9a132afa-654e-11eb-ae93-0242ac130002.json","kind":"sigma"}