AdFindTool
AdFind is a free command-line query tool that can be used for gathering information from Active Directory.From MITRE ATT&CK
Last reported 12 months ago, by The DFIR Report8 reports
ATT&CK techniques
6 of 87 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“ProLock operators used two main vectors of initial access: QakBot (Qbot) and unprotected Remote Desktop Protocol (RDP)-servers with weak credentials.”
- T1053.005Scheduled Task
“In some cases, a scheduled task is used to run PowerShell:”
- T1110Brute Force
“Credential Dumping (T1003), Brute Force (T1110), Input Capture (T1056)”
- T1018Remote System Discovery
“…1482), File and Directory Discovery (T1083), Network Service Scanning (T1046), Network Share Discovery (T1135), Remote System Discovery (T1018)”
- T1036Masquerading
“…Signing (T1116), Deobfuscate/Decode Files or Information (T1140), Disabling Security Tools (T1089), File Deletion (T1107), Masquerading (T1036), Process Injection (T1055)”
- T1046Network Service Discovery
“Account Discovery (T1087), Domain Trust Discovery (T1482), File and Directory Discovery (T1083), Network Service Scanning (T1046), Network Share Discovery (T1135), Remote System Discovery (T1018)”
What the reports say
8 reports, newest first · the exact sentence from each-
From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion“The threat actor then conducted extensive Active Directory reconnaissance using AdFind.”
-
Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs“They leveraged various tools such as AdFind, SharpHound, SoftPerfect NetScan, and GT_NET.exe (Grixba) to map out the environment and perform reconnaissance activities.”
-
Patch or Peril: A Veeam vulnerability incident“Threat actors made use of NetScan, AdFind, and various tools provided by NirSoft to conduct network discovery, enumeration, and credential harvesting.”
-
Ransomware manager: Investigation into farnetwork, a threat actor linked to five strains of ransomware“…ted a ransom of $200,000 in Bitcoin The same report also revealed that Nokoyawa operators used IcedID malware and tools such as PsExec, AdFind, and Cobalt Strike.”
-
REF2924: how to maintain persistence as an (advanced?) threat“The attacker has also deployed open source tools like TFirewall and AdFind in the victim's environment.”
-
REvil Twins: Ransomware-as-a-Service program“Usually, the affiliates need to collect information about Active Directory, so it’s quite common to see evidence of using such tools, as AdFind, ADRecon and Sharphound during the incident investigation.”
-
The Locking Egregor“Once initial access is gained, the threat actors used AdFind to collect Active Directory information.”
-
ATT&CKing ProLock Ransomware“In addition to a wide variety of scripts, attackers use AdFind – another popular tool used by many ransomware groups – to query Active Directory.”
Indicators in its reports
named in the reports above- exploit[.]inin 2 reports
Copy this indicator · defanged
Thanks — we review every report.