1200KM / tool
AdFind — Attack Tool
AdFind is a free command-line query tool that can be used for gathering information from Active Directory.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: AdFind
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- APT29 · G0016 · Pinned relationship source (relationship--b22b0a6c-5960-4232-9fb6-bae84fcc07ca)
- Lotus Blossom · G0030 · Pinned relationship source (relationship--1539a3a4-389a-4be2-a14f-db916a47020f)
- FIN6 · G0037 · Pinned relationship source (relationship--7b7410ad-f09f-49e1-8077-9ffac9d77fcc)
- menuPass · G0045 · Pinned relationship source (relationship--b593a75c-245f-449c-861b-b283c47357f0)
- FIN7 · G0046 · Pinned relationship source (relationship--210b5693-f039-4853-a0ea-70b4fa3abed9)
- TA505 · G0092 · Pinned relationship source (relationship--01253fc1-ee00-438a-ba98-fc8db655b7d3)
- Wizard Spider · G0102 · Pinned relationship source (relationship--1dd1bd5b-8639-48bd-81bd-c34c61fd464a)
- Mustang Panda · G0129 · Pinned relationship source (relationship--95cabb2e-3d68-40c9-8e84-14667ef9ef6a)
- Akira · G1024 · Pinned relationship source (relationship--9092578b-593b-4a4b-ba3f-2bfeed172567)
- INC Ransom · G1032 · Pinned relationship source (relationship--9d2bfb09-9cc8-4b4b-a555-3bac7999d236)
- Play · G1040 · Pinned relationship source (relationship--53c7b735-ba51-43ed-b363-3cf388c97ca0)
- BlackByte · G1043 · Pinned relationship source (relationship--64f429bb-7ddd-473a-8408-7fa0ba9282e3)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
- T1016 · System Network Configuration Discovery · Detection rules & anomalies
- T1018 · Remote System Discovery · Detection rules & anomalies
- T1069.002 · Domain Groups · Detection rules & anomalies
- T1087.002 · Domain Account · Detection rules & anomalies
- T1482 · Domain Trust Discovery · Detection rules & anomalies
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.