AdFind Command Activity

edit

This rule detects the Active Directory query tool, AdFind.exe. AdFind has legitimate purposes, but it is frequently leveraged by threat actors to perform post-exploitation Active Directory reconnaissance. The AdFind tool has been observed in Trickbot, Ryuk, Maze, and FIN6 campaigns. For Winlogbeat, this rule requires Sysmon.

Rule type: eql

Rule indices:

  • logs-endpoint.events.*
  • winlogbeat-*

Severity: low

Risk score: 21

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Discovery

Version: 2 (version history)

Added (Elastic Stack release): 7.11.0

Last modified (Elastic Stack release): 7.11.2

Rule authors: Elastic

Rule license: Elastic License

Investigation guide

edit

AdFind.exe is a legitimate domain query tool. Rule alerts should be investigated to identify if the user has a role that would explain using this tool and that it is being run from an expected directory and endpoint. Leverage the exception workflow in the Kibana Security App or Elasticsearch API to tune this rule to your environment.

Rule query

edit
process where event.type in ("start", "process_started") and
(process.name : "AdFind.exe" or process.pe.original_file_name ==
"AdFind.exe") and process.args : ("objectcategory=computer",
"(objectcategory=computer)",
"objectcategory=person", "(objectcategory=person)",
"objectcategory=subnet", "(objectcategory=subnet)",
"objectcategory=group", "(objectcategory=group)",
"objectcategory=organizationalunit",
"(objectcategory=organizationalunit)",
"objectcategory=attributeschema", "(objectcategory=attributeschema)",
"domainlist", "dcmodes", "adinfo", "dclist", "computers_pwnotreqd",
"trustdmp")

Threat mapping

edit

Framework: MITRE ATT&CKTM

Rule version history

edit
Version 2 (7.11.2 release)
  • Formatting only