Windows File Events: ADExplorer .dat Snapshot Written by ADExp.exe or ADExplorer.exe
Detects ADExplorer exporting an AD snapshot by writing .dat files on Windows.
- Product
- windows
- Category
- file_event
- Author
- Arnim Rupp (Nextron Systems), Thomas Patzke (SigmaHQ), DRL 1.1
- Published
- 2025-07-09
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies instances where ADExplorer executables (ADExp.exe, ADExplorer.exe, ADExplorer64.exe, ADExplorer64a.exe) write a complete Active Directory snapshot to a .dat file. Attackers can use these snapshots to collect directory data for downstream activities such as reconnaissance or password-related targeting, and the exported metadata may support social engineering even without password hashes. Detection relies on Windows file create/write events that include the process image path and the target filename ending in .dat.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer
- github.comhttps://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24
- packetlabs.nethttps://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/
- nccgroup.comhttps://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/
- trustedsec.comhttps://trustedsec.com/blog/adexplorer-on-engagements
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_sysinternals_adexplorer_dump_written.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows File Events: ADExplorer .dat Snapshot Written by ADExp.exe or ADExplorer.exe"
id: 218fd8ea-b59d-4901-afd6-fb7ec5d7de78
related:
- id: 9212f354-7775-4e28-9c9f-8f0a4544e664
type: similar
- id: 0a1255c5-d732-4b62-ac02-b5152d34fb83
type: derived
status: experimental
description: This rule identifies instances where ADExplorer executables (ADExp.exe, ADExplorer.exe, ADExplorer64.exe, ADExplorer64a.exe) write a complete Active Directory snapshot to a .dat file. Attackers can use these snapshots to collect directory data for downstream activities such as reconnaissance or password-related targeting, and the exported metadata may support social engineering even without password hashes. Detection relies on Windows file create/write events that include the process image path and the target filename ending in .dat.
references:
- https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer
- https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24
- https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/
- https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/
- https://trustedsec.com/blog/adexplorer-on-engagements
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_sysinternals_adexplorer_dump_written.yml
author: Arnim Rupp (Nextron Systems), Thomas Patzke, Huntrule Team
date: 2025-07-09
tags:
- attack.discovery
- attack.t1087.002
- attack.t1069.002
- attack.t1482
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \ADExp.exe
- \ADExplorer.exe
- \ADExplorer64.exe
- \ADExplorer64a.exe
TargetFilename|endswith: .dat
condition: selection
falsepositives:
- Legitimate use of ADExplorer by administrators creating .dat snapshots
level: medium
license: DRL-1.1