Windows Process Creation: Renamed AdFind.exe Executions

title: "Windows Process Creation: Renamed AdFind.exe Executions"
id: c59c9642-d49a-4296-97f1-b33376dfa043
status: test
description: This rule flags Windows process creation events where the command line contains indicators consistent with AdFind domain trust and directory discovery, and the original file name is AdFind.exe while the on-disk executable ends with \AdFind.exe (i.e., potentially renamed). Attackers commonly use AdFind to enumerate domain trusts and directory objects to inform subsequent exploitation and lateral movement planning. The detection relies on process command-line content, the OriginalFileName field, and a set of known IMPHASH values tied to the observed AdFind binaries.
references:
  - https://www.joeware.net/freetools/tools/adfind/
  - https://thedfirreport.com/2020/05/08/adfind-recon/
  - https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/
  - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
  - https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
  - https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_adfind.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-21
modified: 2025-02-26
tags:
  - attack.discovery
  - attack.t1018
  - attack.t1087.002
  - attack.t1482
  - attack.t1069.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_1:
    CommandLine|contains:
      - domainlist
      - trustdmp
      - dcmodes
      - adinfo
      - " dclist "
      - computer_pwdnotreqd
      - objectcategory=
      - -subnets -f
      - name="Domain Admins"
      - "-sc u:"
      - domainncs
      - dompol
      - " oudmp "
      - subnetdmp
      - gpodmp
      - fspdmp
      - users_noexpire
      - computers_active
      - computers_pwdnotreqd
  selection_2:
    Hashes|contains:
      - IMPHASH=BCA5675746D13A1F246E2DA3C2217492
      - IMPHASH=53E117A96057EAF19C41380D0E87F1C2
      - IMPHASH=d144de8117df2beceaba2201ad304764
      - IMPHASH=12ce1c0f3f5837ecc18a3782408fa975
      - IMPHASH=4fbf3f084fbbb2470b80b2013134df35
      - IMPHASH=49b639b4acbecc49d72a01f357aa4930
      - IMPHASH=680dad9e300346e05a85023965867201
      - IMPHASH=21aa085d54992511b9f115355e468782
  selection_3:
    OriginalFileName: AdFind.exe
  filter:
    Image|endswith: \AdFind.exe
  condition: 1 of selection* and not filter
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_adfind/info.yml
license: DRL-1.1
related:
  - id: df55196f-f105-44d3-a675-e9dfb6cc2f2b
    type: derived