name: Windows AdFind Exe
id: bd3b0187-189b-46c0-be45-f52da2bae67f
version: 2
date: '2021-11-03'
author: Jose Hernandez, Bhavin Patel, Splunk
status: production
type: TTP
description: 'This search looks for the execution of `adfind.exe` with command-line
  arguments that it uses by default. Specifically the filter or search functions.
  It also considers the arguments necessary like objectcategory, see readme for more
  details: https://www.joeware.net/freetools/tools/adfind/usage.htm. This has been
  seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST.
  AdFind.exe is usually used a recon tool to enumare a domain controller.'
data_source:
- Sysmon Event ID 1
search:
  selection1:
    CommandLine:
    - '*objectcategory*'
    - '* -gcb *'
    - '* -sc *'
  selection2:
    CommandLine:
    - '* -f *'
    - '* -b *'
  condition: selection1 and selection2
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, and command-line executions from your endpoints. If
  you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: administrators rarely use adfind, usually not used for legitimate
  reasons
references:
- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
- https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption
tags:
  analytic_story:
  - NOBELIUM Group
  - Domain Trust Discovery
  asset_type: Endpoint
  confidence: 50
  impact: 50
  message: Windows AdFind Exe
  mitre_attack_id:
  - T1018
  observable:
  - name: user
    type: User
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 25.0
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog