Windows PUA: Suspicious Active Directory enumeration using AdFind.exe flags

Flags AdFind.exe processes that look like Active Directory discovery via password policy and object enumeration options.

FreeUnreviewedSigmahighv1

windows-pua-suspicious-active-directory-enumeration-using-adfind-exe-flags-455b9d50

title: "Windows PUA: Suspicious Active Directory enumeration using AdFind.exe flags"
id: dc8d49e6-71e6-4247-b6a9-a93b7fb632de
related:
  - id: 9a132afa-654e-11eb-ae93-0242ac130002
    type: similar
  - id: 514e7e3e-b3b4-4a67-af60-be20f139198b
    type: similar
  - id: 455b9d50-15a1-4b99-853f-8d37655a4c1b
    type: derived
status: test
description: This rule identifies process creation where AdFind.exe command lines include specific Active Directory discovery flags. Attackers often use AdFind to enumerate directory attributes and object collections to support further access and privilege escalation planning. The detection relies on Windows process creation telemetry with access to the full command line content matching known flag strings.
references:
  - https://www.joeware.net/freetools/tools/adfind/
  - https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_adfind_enumeration.yml
author: frack113, Huntrule Team
date: 2021-12-13
modified: 2023-03-05
tags:
  - attack.discovery
  - attack.t1087.002
logsource:
  product: windows
  category: process_creation
detection:
  selection_password:
    CommandLine|contains:
      - lockoutduration
      - lockoutthreshold
      - lockoutobservationwindow
      - maxpwdage
      - minpwdage
      - minpwdlength
      - pwdhistorylength
      - pwdproperties
  selection_enum_ad:
    CommandLine|contains: -sc admincountdmp
  selection_enum_exchange:
    CommandLine|contains: -sc exchaddresses
  condition: 1 of selection_*
falsepositives:
  - Authorized administrative activity
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_enumeration/info.yml
license: DRL-1.1

What it detects

This rule identifies process creation where AdFind.exe command lines include specific Active Directory discovery flags. Attackers often use AdFind to enumerate directory attributes and object collections to support further access and privilege escalation planning. The detection relies on Windows process creation telemetry with access to the full command line content matching known flag strings.

Known false positives

Authorized administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.