Renamed AdFind Execution

Severity: high
Author: Florian Roth (Nextron Systems)
Source: upstream

Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1018` Remote System Discovery, `T1069.002` Permission Groups Discovery: Domain Groups, `T1087.002` Account Discovery: Domain Account, `T1482` Domain Trust Discovery

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `1 of selection_1`

or:
CommandLine|contains: ' dclist '
CommandLine|contains: ' oudmp '
CommandLine|contains: '-sc u:'
CommandLine|contains: '-subnets -f'
CommandLine|contains: adinfo
CommandLine|contains: computer_pwdnotreqd
CommandLine|contains: computers_active
CommandLine|contains: computers_pwdnotreqd
CommandLine|contains: dcmodes
CommandLine|contains: domainlist
CommandLine|contains: domainncs
CommandLine|contains: dompol
CommandLine|contains: fspdmp
CommandLine|contains: gpodmp
CommandLine|contains: 'name="Domain Admins"'
CommandLine|contains: 'objectcategory='
CommandLine|contains: subnetdmp
CommandLine|contains: trustdmp
CommandLine|contains: users_noexpire

Stage 2: `1 of selection_2`

or:
Hashes|contains: 'IMPHASH=12ce1c0f3f5837ecc18a3782408fa975'
Hashes|contains: 'IMPHASH=21aa085d54992511b9f115355e468782'
Hashes|contains: 'IMPHASH=49b639b4acbecc49d72a01f357aa4930'
Hashes|contains: 'IMPHASH=4fbf3f084fbbb2470b80b2013134df35'
Hashes|contains: 'IMPHASH=53E117A96057EAF19C41380D0E87F1C2'
Hashes|contains: 'IMPHASH=680dad9e300346e05a85023965867201'
Hashes|contains: 'IMPHASH=BCA5675746D13A1F246E2DA3C2217492'
Hashes|contains: 'IMPHASH=d144de8117df2beceaba2201ad304764'

Stage 3: `1 of selection_3`

OriginalFileName: AdFind.exe

Stage 4: `not filter`

Image|endswith: '\AdFind.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`dclist` `oudmp` corpus 2 (sigma 2) `-sc u:` corpus 2 (sigma 2) `-subnets -f` corpus 2 (sigma 2) `adinfo` corpus 2 (sigma 2) `computer_pwdnotreqd` corpus 2 (sigma 2) `computers_active` corpus 2 (sigma 2) `computers_pwdnotreqd` corpus 2 (sigma 2) `dcmodes` corpus 2 (sigma 2) `domainlist` corpus 2 (sigma 2) `domainncs` corpus 2 (sigma 2) `dompol` corpus 2 (sigma 2) `fspdmp` corpus 2 (sigma 2) `gpodmp` corpus 2 (sigma 2) `name="Domain Admins"` corpus 2 (sigma 2) `objectcategory=` corpus 2 (sigma 2) `subnetdmp` corpus 2 (sigma 2) `trustdmp` corpus 2 (sigma 2) `users_noexpire` corpus 2 (sigma 2)
`Hashes`	match	`IMPHASH=12ce1c0f3f5837ecc18a3782408fa975` corpus 2 (sigma 2) `IMPHASH=21aa085d54992511b9f115355e468782` corpus 2 (sigma 2) `IMPHASH=49b639b4acbecc49d72a01f357aa4930` corpus 2 (sigma 2) `IMPHASH=4fbf3f084fbbb2470b80b2013134df35` corpus 2 (sigma 2) `IMPHASH=53E117A96057EAF19C41380D0E87F1C2` `IMPHASH=680dad9e300346e05a85023965867201` corpus 2 (sigma 2) `IMPHASH=BCA5675746D13A1F246E2DA3C2217492` `IMPHASH=d144de8117df2beceaba2201ad304764` corpus 2 (sigma 2)
`Image`	ends_with	`\AdFind.exe` corpus 2 (sigma 2)
`OriginalFileName`	eq	`AdFind.exe` corpus 2 (sigma 2)

Renamed AdFind Execution

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: 1 of selection_1

Stage 2: 1 of selection_2

Stage 3: 1 of selection_3

Stage 4: not filter

Indicators

Stage 1: `1 of selection_1`

Stage 2: `1 of selection_2`

Stage 3: `1 of selection_3`

Stage 4: `not filter`