name: Windows AdFind Exe
id: bd3b0187-189b-46c0-be45-f52da2bae67f
version: 1
date: '2020-12-16'
author: Jose Hernandez, Splunk
type: batch
datamodel:
- Endpoint
description: 'This search looks for the execution of `adfind.exe` with command-line
  arguments that it uses by default. Specifically the filter or search functions.
  It also considers the arguments necessary like objectcategory, see readme for more
  details: https://www.joeware.net/freetools/tools/adfind/usage.htm. This has been
  seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST.
  AdFind.exe is usually used a recon tool to enumare a domain controller.'
search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime
  max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process=*-f*
  OR Processes.process=*-b*) AND (Processes.process=*objectcategory* OR Processes.process=*-gcb*
  OR Processes.process=*-sc*) by Processes.dest Processes.user Processes.process_name
  Processes.process  Processes.parent_process Processes.process_id Processes.parent_process_id
  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `windows_adfind_exe_filter` '
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, and command-line executions from your endpoints. If
  you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: administrators rarely use adfind, usually not used for legitimate
  reasons
references:
- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
- https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html
tags:
  analytic_story:
  - NOBELIUM Group
  asset_type: Endpoint
  cis20:
  - CIS 8
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
  - T1018
  nist:
  - PR.PT
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.process
  - Processes.dest
  - Processes.user
  - Processes.process_name
  - Processes.parent_process
  - Processes.process_id
  - Processes.parent_process_id
  security_domain: endpoint
