Branch was auto-updated.

detections/endpoint/windows_adfind_exe.yml

@@ -1,16 +1,14 @@
 name: Windows AdFind Exe
 id: bd3b0187-189b-46c0-be45-f52da2bae67f
-version: 2
-date: '2021-11-03'
+version: 3
+date: '2023-05-15'
 author: Jose Hernandez, Bhavin Patel, Splunk
 status: production
 type: TTP
 description: 'This search looks for the execution of `adfind.exe` with command-line
-  arguments that it uses by default. Specifically the filter or search functions.
+  arguments that it uses by default specifically the filter or search functions.
   It also considers the arguments necessary like objectcategory, see readme for more
-  details: https://www.joeware.net/freetools/tools/adfind/usage.htm. This has been
-  seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST.
-  AdFind.exe is usually used a recon tool to enumare a domain controller.'
+  details: https://www.joeware.net/freetools/tools/adfind/usage.htm. AdFind.exe is a powerful tool that is commonly used for querying and retrieving information from Active Directory (AD). While it is primarily designed for AD administration and management, it has been seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST.'
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -23,11 +21,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, and command-line executions from your endpoints. If
   you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: administrators rarely use adfind, usually not used for legitimate
-  reasons
+known_false_positives: ADfind is a command-line tool for AD administration and management that is seen to be leveraged by various adversaries. Filter out legitimate administrator usage using the filter macro.
 references:
 - https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
 - https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption
+- https://www.joeware.net/freetools/tools/adfind/index.htm
 tags:
   analytic_story:
   - NOBELIUM Group