From 780392da4242f851920866d0b9c7e438636518ca Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 15 May 2023 10:29:38 -0700 Subject: [PATCH 1/2] fix up text --- detections/endpoint/windows_adfind_exe.yml | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index 357f46c182..2488c6e306 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -1,16 +1,14 @@ name: Windows AdFind Exe id: bd3b0187-189b-46c0-be45-f52da2bae67f -version: 2 -date: '2021-11-03' +version: 3 +date: '2023-05-15' author: Jose Hernandez, Bhavin Patel, Splunk status: production type: TTP description: 'This search looks for the execution of `adfind.exe` with command-line - arguments that it uses by default. Specifically the filter or search functions. + arguments that it uses by default specifically the filter or search functions. It also considers the arguments necessary like objectcategory, see readme for more - details: https://www.joeware.net/freetools/tools/adfind/usage.htm. This has been - seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST. - AdFind.exe is usually used a recon tool to enumare a domain controller.' + details: https://www.joeware.net/freetools/tools/adfind/usage.htm. AdFind.exe is a powerful tool that is commonly used for querying and retrieving information from Active Directory (AD). While it is primarily designed for AD administration and management, it has been seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST.' data_source: - Sysmon Event ID 1 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -23,11 +21,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: administrators rarely use adfind, usually not used for legitimate - reasons +known_false_positives: ADfind is a legitimate tool for AD administration and management. Filter out legitimate admin usage using the macro. references: - https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ - https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption +- https://www.joeware.net/freetools/tools/adfind/index.htm tags: analytic_story: - NOBELIUM Group From e2b2ead939763badc336611a8867408ed9d52999 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 15 May 2023 10:40:51 -0700 Subject: [PATCH 2/2] fix up text --- detections/endpoint/windows_adfind_exe.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index 2488c6e306..fcb9447740 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -21,7 +21,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: ADfind is a legitimate tool for AD administration and management. Filter out legitimate admin usage using the macro. +known_false_positives: ADfind is a command-line tool for AD administration and management that is seen to be leveraged by various adversaries. Filter out legitimate administrator usage using the filter macro. references: - https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/ - https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption