Windows Process Creation: Renamed AdFind.exe Executions
Detects renamed AdFind.exe executions using AdFind-style domain discovery command-line indicators, OriginalFileName, and known binary hashes.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-21
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the command line contains indicators consistent with AdFind domain trust and directory discovery, and the original file name is AdFind.exe while the on-disk executable ends with \AdFind.exe (i.e., potentially renamed). Attackers commonly use AdFind to enumerate domain trusts and directory objects to inform subsequent exploitation and lateral movement planning. The detection relies on process command-line content, the OriginalFileName field, and a set of known IMPHASH values tied to the observed AdFind binaries.
Reporting behind it
- joeware.nethttps://www.joeware.net/freetools/tools/adfind/
- thedfirreport.comhttps://thedfirreport.com/2020/05/08/adfind-recon/
- thedfirreport.comhttps://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/
- microsoft.comhttps://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
- social.technet.microsoft.comhttps://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
- github.comhttps://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_adfind.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Renamed AdFind.exe Executions"
id: c59c9642-d49a-4296-97f1-b33376dfa043
status: test
description: This rule flags Windows process creation events where the command line contains indicators consistent with AdFind domain trust and directory discovery, and the original file name is AdFind.exe while the on-disk executable ends with \AdFind.exe (i.e., potentially renamed). Attackers commonly use AdFind to enumerate domain trusts and directory objects to inform subsequent exploitation and lateral movement planning. The detection relies on process command-line content, the OriginalFileName field, and a set of known IMPHASH values tied to the observed AdFind binaries.
references:
- https://www.joeware.net/freetools/tools/adfind/
- https://thedfirreport.com/2020/05/08/adfind-recon/
- https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
- https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
- https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_adfind.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-21
modified: 2025-02-26
tags:
- attack.discovery
- attack.t1018
- attack.t1087.002
- attack.t1482
- attack.t1069.002
logsource:
category: process_creation
product: windows
detection:
selection_1:
CommandLine|contains:
- domainlist
- trustdmp
- dcmodes
- adinfo
- " dclist "
- computer_pwdnotreqd
- objectcategory=
- -subnets -f
- name="Domain Admins"
- "-sc u:"
- domainncs
- dompol
- " oudmp "
- subnetdmp
- gpodmp
- fspdmp
- users_noexpire
- computers_active
- computers_pwdnotreqd
selection_2:
Hashes|contains:
- IMPHASH=BCA5675746D13A1F246E2DA3C2217492
- IMPHASH=53E117A96057EAF19C41380D0E87F1C2
- IMPHASH=d144de8117df2beceaba2201ad304764
- IMPHASH=12ce1c0f3f5837ecc18a3782408fa975
- IMPHASH=4fbf3f084fbbb2470b80b2013134df35
- IMPHASH=49b639b4acbecc49d72a01f357aa4930
- IMPHASH=680dad9e300346e05a85023965867201
- IMPHASH=21aa085d54992511b9f115355e468782
selection_3:
OriginalFileName: AdFind.exe
filter:
Image|endswith: \AdFind.exe
condition: 1 of selection* and not filter
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_adfind/info.yml
license: DRL-1.1
related:
- id: df55196f-f105-44d3-a675-e9dfb6cc2f2b
type: derived