Windows File Writes by ADExplorer Creating Complete AD Snapshot .dat Files

title: Windows File Writes by ADExplorer Creating Complete AD Snapshot .dat Files
id: 218fd8ea-b59d-4901-afd6-fb7ec5d7de78
related:
  - id: 9212f354-7775-4e28-9c9f-8f0a4544e664
    type: similar
  - id: 0a1255c5-d732-4b62-ac02-b5152d34fb83
    type: derived
status: experimental
description: This rule flags Windows file creation where ADExplorer executables write a .dat file, consistent with exporting a complete Active Directory snapshot. Attackers can use these snapshots to support downstream discovery and data collection activity. The detection relies on file event telemetry capturing the process image path ending with ADExplorer binaries and the target filename ending with .dat.
references:
  - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer
  - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24
  - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/
  - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/
  - https://trustedsec.com/blog/adexplorer-on-engagements
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_sysinternals_adexplorer_dump_written.yml
author: Arnim Rupp (Nextron Systems), Thomas Patzke, Huntrule Team
date: 2025-07-09
tags:
  - attack.discovery
  - attack.t1087.002
  - attack.t1069.002
  - attack.t1482
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
      - \ADExp.exe
      - \ADExplorer.exe
      - \ADExplorer64.exe
      - \ADExplorer64a.exe
    TargetFilename|endswith: .dat
  condition: selection
falsepositives:
  - Legitimate use of ADExplorer by administrators creating .dat snapshots
level: medium
license: DRL-1.1