huntrule

Windows Process Creation: AdFind.exe Execution for Active Directory Recon

Alerts on Windows execution of AdFind.exe based on image/name and known imphash values indicative of AD reconnaissance.

FreeUnreviewedSigmamediumv1
title: "Windows Process Creation: AdFind.exe Execution for Active Directory Recon"
id: 3651b0f6-f7c7-4f6c-8b60-81d16ef6474a
related:
  - id: 455b9d50-15a1-4b99-853f-8d37655a4c1b
    type: similar
  - id: 514e7e3e-b3b4-4a67-af60-be20f139198b
    type: derived
status: experimental
description: This rule flags the execution of AdFind.exe on Windows by matching the process image name, original file name, and specific imphash values. AdFind is commonly used to gather information in Active Directory environments, which can support attacker discovery and lateral movement planning. Detection relies on process creation telemetry, including the executable path/name and file hashing/imphash data.
references:
  - https://www.joeware.net/freetools/tools/adfind/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_adfind_execution.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-02-26
tags:
  - attack.discovery
  - attack.t1087.002
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    - Image|endswith: \AdFind.exe
    - OriginalFileName: AdFind.exe
    - Hashes|contains:
        - IMPHASH=d144de8117df2beceaba2201ad304764
        - IMPHASH=12ce1c0f3f5837ecc18a3782408fa975
        - IMPHASH=bca5675746d13a1f246e2da3c2217492
        - IMPHASH=4fbf3f084fbbb2470b80b2013134df35
        - IMPHASH=49b639b4acbecc49d72a01f357aa4930
        - IMPHASH=53e117a96057eaf19c41380d0e87f1c2
        - IMPHASH=680dad9e300346e05a85023965867201
        - IMPHASH=21aa085d54992511b9f115355e468782
  condition: selection
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_execution/info.yml
license: DRL-1.1

What it detects

This rule flags the execution of AdFind.exe on Windows by matching the process image name, original file name, and specific imphash values. AdFind is commonly used to gather information in Active Directory environments, which can support attacker discovery and lateral movement planning. Detection relies on process creation telemetry, including the executable path/name and file hashing/imphash data.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.