Windows: Sysinternals ADExplorer invoked with snapshot flag to create AD database snapshot

Flags Sysinternals ADExplorer running with "snapshot" to create a local Active Directory database copy.

FreeUnreviewedSigmamediumv1

windows-sysinternals-adexplorer-invoked-with-snapshot-flag-to-create-ad-database-9212f354

title: "Windows: Sysinternals ADExplorer invoked with snapshot flag to create AD database snapshot"
id: 26f02d70-55f5-4056-b565-f4d23bfa7c6d
related:
  - id: ef61af62-bc74-4f58-b49b-626448227652
    type: derived
  - id: 9212f354-7775-4e28-9c9f-8f0a4544e664
    type: derived
status: test
description: This rule identifies execution of Sysinternals ADExplorer when the command line includes the "snapshot" flag, indicating an attempt to save a local copy of the Active Directory database. Attackers may use this snapshot to extract data for analysis or enable subsequent credential and social engineering activities, even though password hashes are not included. It relies on Windows process creation telemetry and matches the executable identity (ADExplorer variants) plus the presence of the snapshot parameter in the command line.
references:
  - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html
  - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer
  - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24
  - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/
  - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/
  - https://trustedsec.com/blog/adexplorer-on-engagements
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_adexplorer_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-14
modified: 2025-07-09
tags:
  - attack.discovery
  - attack.t1087.002
  - attack.t1069.002
  - attack.t1482
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \ADExp.exe
        - \ADExplorer.exe
        - \ADExplorer64.exe
        - \ADExplorer64a.exe
    - OriginalFileName: AdExp
    - Description: Active Directory Editor
    - Product: Sysinternals ADExplorer
  selection_cli:
    CommandLine|contains: snapshot
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule identifies execution of Sysinternals ADExplorer when the command line includes the "snapshot" flag, indicating an attempt to save a local copy of the Active Directory database. Attackers may use this snapshot to extract data for analysis or enable subsequent credential and social engineering activities, even though password hashes are not included. It relies on Windows process creation telemetry and matches the executable identity (ADExplorer variants) plus the presence of the snapshot parameter in the command line.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.