Windows Process Creation: AdFind Executed with Suspicious Recon Flags

Detects AdFind executions on Windows that include common AD reconnaissance parameters.

FreeUnreviewedSigmahighv1

windows-process-creation-adfind-executed-with-suspicious-recon-flags-9a132afa

title: "Windows Process Creation: AdFind Executed with Suspicious Recon Flags"
id: c2c21151-d8aa-4530-b222-f7224856981f
related:
  - id: 455b9d50-15a1-4b99-853f-8d37655a4c1b
    type: similar
  - id: 75df3b17-8bcc-4565-b89b-c9898acef911
    type: obsolete
  - id: 9a132afa-654e-11eb-ae93-0242ac130002
    type: derived
status: test
description: This rule flags AdFind launched with command-line arguments commonly associated with Active Directory discovery and related reconnaissance. Such usage matters because attackers may query domain information (including domain admin-related targets and computer/domain enumeration flags) to map environments before further exploitation. It relies on Windows process creation telemetry and matching specific AdFind command-line substrings.
references:
  - https://www.joeware.net/freetools/tools/adfind/
  - https://thedfirreport.com/2020/05/08/adfind-recon/
  - https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/
  - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
  - https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
  - https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md
  - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1087.002/T1087.002.md#atomic-test-7---adfind---enumerate-active-directory-user-objects
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage.yml
author: Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community, Huntrule Team
date: 2021-02-02
modified: 2025-10-24
tags:
  - attack.discovery
  - attack.t1018
  - attack.t1087.002
  - attack.t1482
  - attack.t1069.002
  - stp.1u
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - domainlist
      - trustdmp
      - dcmodes
      - adinfo
      - -sc dclist
      - computer_pwdnotreqd
      - objectcategory=
      - -subnets -f
      - name="Domain Admins"
      - "-sc u:"
      - domainncs
      - dompol
      - " oudmp "
      - subnetdmp
      - gpodmp
      - fspdmp
      - users_noexpire
      - computers_active
      - computers_pwdnotreqd
  condition: selection
falsepositives:
  - Legitimate admin activity
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage/info.yml
simulation:
  - type: atomic-red-team
    name: Adfind - Enumerate Active Directory Computer Objects
    technique: T1018
    atomic_guid: a889f5be-2d54-4050-bd05-884578748bb4
  - type: atomic-red-team
    name: Adfind - Enumerate Active Directory Domain Controller Objects
    technique: T1018
    atomic_guid: 5838c31e-a0e2-4b9f-b60a-d79d2cb7995e
license: DRL-1.1

What it detects

This rule flags AdFind launched with command-line arguments commonly associated with Active Directory discovery and related reconnaissance. Such usage matters because attackers may query domain information (including domain admin-related targets and computer/domain enumeration flags) to map environments before further exploitation. It relies on Windows process creation telemetry and matching specific AdFind command-line substrings.

Known false positives

Legitimate admin activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.