{"id":"T1087.002","name":"Domain Account","url":"https://attack.mitre.org/techniques/T1087/002","tactics":["discovery"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0129","stix_id":"x-mitre-detection-strategy--50569af3-7910-4591-977e-cbf4caa12cfd","name":"Domain Account Enumeration Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0129","analytics":[{"id":"AN0363","stix_id":"x-mitre-analytic--8f0ac116-4c8a-4819-b7c0-744e05d672c9","name":"Analytic 0363","description":"Adversary enumeration of domain accounts using net.exe, PowerShell, WMI, or LDAP queries from non-domain controllers or non-admin endpoints.","url":"https://attack.mitre.org/detectionstrategies/DET0129#AN0363","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"NSM:Flow","channel":"LDAP Bind/Search","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"CommandLinePattern","description":"Detect variations of 'net user /domain', 'Get-ADUser', 'Get-ADGroupMember'."},{"field":"TimeWindow","description":"Tune detection for bursts of enumeration commands or search queries."},{"field":"SourceHost","description":"Restrict detection to non-DC or non-admin systems where such commands are unexpected."}],"live":true,"detection_strategies":["DET0129"],"techniques":["T1087.002"]},{"id":"AN0364","stix_id":"x-mitre-analytic--4bad86cf-6cab-46f4-8748-28dc8c8ec81b","name":"Analytic 0364","description":"Domain account enumeration using ldapsearch, samba tools (e.g., 'wbinfo -u'), or winbindd lookups.","url":"https://attack.mitre.org/detectionstrategies/DET0129#AN0364","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linuxsyslog","channel":"nslcd or winbind logs","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"linuxsyslog"},{"name":"NSM:Flow","channel":"LDAP Query","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ProcessName","description":"Detect suspicious use of ldapsearch, wbinfo, getent passwd, or samba enumeration tools."},{"field":"LDAPSearchFilter","description":"Tune for high-volume or broad-scope LDAP queries."},{"field":"UserContext","description":"Apply filters for unexpected users or service accounts executing the behavior."}],"live":true,"detection_strategies":["DET0129"],"techniques":["T1087.002"]},{"id":"AN0365","stix_id":"x-mitre-analytic--ef50b854-172a-457b-9d0e-c95d9835eaaa","name":"Analytic 0365","description":"Domain group and user enumeration via dscl or dscacheutil, or queries to directory services from non-admin endpoints.","url":"https://attack.mitre.org/detectionstrategies/DET0129#AN0365","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Process Execution","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"DS daemon log entries","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"CommandPattern","description":"Match patterns such as 'dscl /Active\\ Directory/All\\ Domains -list /Users'."},{"field":"EndpointRole","description":"Flag this activity only on non-directory hosts or non-admin accounts."}],"live":true,"detection_strategies":["DET0129"],"techniques":["T1087.002"]}],"live":true,"version":"1.0","techniques":["T1087.002"]}],"sigma_rules":[{"id":"02030f2f-6199-49ec-b258-ea71b07e03dc","title":"Malicious PowerShell Commandlets - ProcessCreation","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-01-02","modified":"2025-12-10","description":"Detects Commandlet names from well-known PowerShell exploitation frameworks","references":["https://adsecurity.org/?p=2921","https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries","https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1","https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1","https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1","https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1","https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/","https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/","https://github.com/calebstewart/CVE-2021-1675","https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1","https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html","https://github.com/HarmJ0y/DAMP","https://github.com/samratashok/nishang","https://github.com/DarkCoderSc/PowerRunAsSystem/","https://github.com/besimorhino/powercat","https://github.com/Kevin-Robertson/Powermad","https://github.com/adrecon/ADRecon","https://github.com/adrecon/AzureADRecon","https://github.com/sadshade/veeam-creds/blob/6010eaf31ba41011b58d6af3950cffbf6f5cea32/Veeam-Get-Creds.ps1","https://github.com/The-Viper-One/Invoke-PowerDPAPI/","https://github.com/Arno0x/DNSExfiltrator/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.discovery","attack.t1482","attack.t1087","attack.t1087.001","attack.t1087.002","attack.t1069.001","attack.t1069.002","attack.t1069","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_malicious_cmdlets.yml","techniques":["T1482","T1087","T1087.001","T1087.002","T1069.001","T1069.002","T1069","T1059.001"],"cves":[]},{"id":"02773bed-83bf-469f-b7ff-e676e7d78bab","title":"BloodHound Collection Files","author":"C.J. May","status":"test","level":"high","date":"2022-08-09","modified":"2026-02-19","description":"Detects default file names outputted by the BloodHound collection tool SharpHound","references":["https://academy.hackthebox.com/course/preview/active-directory-bloodhound/bloodhound--data-collection"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.discovery","attack.t1087.001","attack.t1087.002","attack.t1482","attack.t1069.001","attack.t1069.002","attack.execution","attack.t1059.001"],"path":"rules/windows/file/file_event/file_event_win_bloodhound_collection.yml","techniques":["T1087.001","T1087.002","T1482","T1069.001","T1069.002","T1059.001"],"cves":[]},{"id":"0a1255c5-d732-4b62-ac02-b5152d34fb83","title":"ADExplorer Writing Complete AD Snapshot Into .dat File","author":"Arnim Rupp (Nextron Systems), Thomas Patzke","status":"experimental","level":"medium","date":"2025-07-09","modified":null,"description":"Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.","references":["https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer","https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24","https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/","https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/","https://trustedsec.com/blog/adexplorer-on-engagements"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.discovery","attack.t1087.002","attack.t1069.002","attack.t1482"],"path":"rules/windows/file/file_event/file_event_win_sysinternals_adexplorer_dump_written.yml","techniques":["T1087.002","T1069.002","T1482"],"cves":[]},{"id":"183e7ea8-ac4b-4c23-9aec-b3dac4e401ac","title":"Net.EXE Execution","author":"Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)","status":"test","level":"low","date":"2019-01-16","modified":"2022-07-11","description":"Detects execution of \"Net.EXE\".","references":["https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/","https://eqllib.readthedocs.io/en/latest/analytics/4d2e7fc1-af0b-4915-89aa-03d25ba7805e.html","https://eqllib.readthedocs.io/en/latest/analytics/e61f557c-a9d0-4c25-ab5b-bbc46bb24deb.html","https://eqllib.readthedocs.io/en/latest/analytics/9b3dd402-891c-4c4d-a662-28947168ce61.html","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1007/T1007.md#atomic-test-2---system-service-discovery---netexe"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1007","attack.t1049","attack.t1018","attack.t1135","attack.t1201","attack.t1069.001","attack.t1069.002","attack.t1087.001","attack.t1087.002","attack.lateral-movement","attack.t1021.002","attack.s0039","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_net_execution.yml","techniques":["T1007","T1049","T1018","T1135","T1201","T1069.001","T1069.002","T1087.001","T1087.002","T1021.002"],"cves":[]},{"id":"31d68132-4038-47c7-8f8e-635a39a7c174","title":"Potential Active Directory Reconnaissance/Enumeration Via LDAP","author":"Adeem Mawani","status":"test","level":"medium","date":"2021-06-22","modified":"2025-07-04","description":"Detects potential Active Directory enumeration via LDAP","references":["https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726","https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1","https://github.com/BloodHoundAD/SharpHound3/blob/7d96b991b1887ff50349ce59c80980bc0d95c86a/SharpHound3/LdapBuilder.cs","https://medium.com/falconforce/falconfriday-detecting-active-directory-data-collection-0xff21-c22d1a57494c","https://github.com/fox-it/BloodHound.py/blob/d65eb614831cd30f26028ccb072f5e77ca287e0b/bloodhound/ad/domain.py#L427","https://ipurple.team/2024/07/15/sharphound-detection/"],"logsource":{"product":"windows","service":"ldap"},"tags":["attack.discovery","attack.t1069.002","attack.t1087.002","attack.t1482"],"path":"rules/windows/builtin/ldap/win_ldap_recon.yml","techniques":["T1069.002","T1087.002","T1482"],"cves":[]},{"id":"35ba1d85-724d-42a3-889f-2e2362bcaf23","title":"AD Privileged Users or Groups Reconnaissance","author":"Samir Bousseaden","status":"test","level":"high","date":"2019-04-03","modified":"2022-07-13","description":"Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs","references":["https://web.archive.org/web/20230329163438/https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.discovery","attack.t1087.002"],"path":"rules/windows/builtin/security/win_security_account_discovery.yml","techniques":["T1087.002"],"cves":[]},{"id":"36bed6b2-e9a0-4fff-beeb-413a92b86138","title":"Active Directory Computers Enumeration With Get-AdComputer","author":"frack113","status":"test","level":"low","date":"2022-03-17","modified":"2023-07-08","description":"Detects usage of the \"Get-AdComputer\" to enumerate Computers or properties within Active Directory.","references":["https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md","https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1087.002/T1087.002.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.t1018","attack.t1087.002"],"path":"rules/windows/powershell/powershell_script/posh_ps_get_adcomputer.yml","techniques":["T1018","T1087.002"],"cves":[]},{"id":"455b9d50-15a1-4b99-853f-8d37655a4c1b","title":"PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE","author":"frack113","status":"test","level":"high","date":"2021-12-13","modified":"2023-03-05","description":"Detects active directory enumeration activity using known AdFind CLI flags","references":["https://www.joeware.net/freetools/tools/adfind/","https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1087.002"],"path":"rules/windows/process_creation/proc_creation_win_pua_adfind_enumeration.yml","techniques":["T1087.002"],"cves":[]},{"id":"514e7e3e-b3b4-4a67-af60-be20f139198b","title":"PUA - AdFind.EXE Execution","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-02-26","modified":null,"description":"Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment","references":["https://www.joeware.net/freetools/tools/adfind/","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1087.002"],"path":"rules/windows/process_creation/proc_creation_win_pua_adfind_execution.yml","techniques":["T1087.002"],"cves":[]},{"id":"7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c","title":"Malicious PowerShell Commandlets - PoshModule","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-01-20","modified":"2025-12-10","description":"Detects Commandlet names from well-known PowerShell exploitation frameworks","references":["https://adsecurity.org/?p=2921","https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries","https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1","https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1","https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1","https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1","https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/","https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/","https://github.com/calebstewart/CVE-2021-1675","https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1","https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html","https://github.com/HarmJ0y/DAMP","https://github.com/samratashok/nishang","https://github.com/DarkCoderSc/PowerRunAsSystem/","https://github.com/besimorhino/powercat","https://github.com/Kevin-Robertson/Powermad","https://github.com/adrecon/ADRecon","https://github.com/adrecon/AzureADRecon","https://github.com/sadshade/veeam-creds/blob/6010eaf31ba41011b58d6af3950cffbf6f5cea32/Veeam-Get-Creds.ps1","https://github.com/The-Viper-One/Invoke-PowerDPAPI/","https://github.com/Arno0x/DNSExfiltrator/"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.execution","attack.discovery","attack.t1482","attack.t1087","attack.t1087.001","attack.t1087.002","attack.t1069.001","attack.t1069.002","attack.t1069","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_malicious_commandlets.yml","techniques":["T1482","T1087","T1087.001","T1087.002","T1069.001","T1069.002","T1069","T1059.001"],"cves":[]},{"id":"89819aa4-bbd6-46bc-88ec-c7f7fe30efa6","title":"Malicious PowerShell Commandlets - ScriptBlock","author":"Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer","status":"test","level":"high","date":"2017-03-05","modified":"2025-12-10","description":"Detects Commandlet names from well-known PowerShell exploitation frameworks","references":["https://adsecurity.org/?p=2921","https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries","https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1","https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1","https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1","https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1","https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/","https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/","https://github.com/calebstewart/CVE-2021-1675","https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1","https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html","https://github.com/HarmJ0y/DAMP","https://github.com/samratashok/nishang","https://github.com/DarkCoderSc/PowerRunAsSystem/","https://github.com/besimorhino/powercat","https://github.com/Kevin-Robertson/Powermad","https://github.com/adrecon/ADRecon","https://github.com/adrecon/AzureADRecon","https://github.com/The-Viper-One/Invoke-PowerDPAPI/","https://github.com/Arno0x/DNSExfiltrator/"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.discovery","attack.t1482","attack.t1087","attack.t1087.001","attack.t1087.002","attack.t1069.001","attack.t1069.002","attack.t1069","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml","techniques":["T1482","T1087","T1087.001","T1087.002","T1069.001","T1069.002","T1069","T1059.001"],"cves":[]},{"id":"9212f354-7775-4e28-9c9f-8f0a4544e664","title":"Active Directory Database Snapshot Via ADExplorer","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-03-14","modified":"2025-07-09","description":"Detects the execution of Sysinternals ADExplorer with the \"-snapshot\" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.","references":["https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html","https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer","https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24","https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/","https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/","https://trustedsec.com/blog/adexplorer-on-engagements"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1087.002","attack.t1069.002","attack.t1482"],"path":"rules/windows/process_creation/proc_creation_win_sysinternals_adexplorer_execution.yml","techniques":["T1087.002","T1069.002","T1482"],"cves":[]},{"id":"968eef52-9cff-4454-8992-1e74b9cbad6c","title":"Reconnaissance Activity","author":"Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community","status":"test","level":"high","date":"2017-03-07","modified":"2022-08-22","description":"Detects activity as \"net user administrator /domain\" and \"net group domain admins /domain\"","references":["https://findingbad.blogspot.de/2017/01/hunting-what-does-it-look-like.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.discovery","attack.t1087.002","attack.t1069.002","attack.s0039"],"path":"rules/windows/builtin/security/win_security_susp_net_recon_activity.yml","techniques":["T1087.002","T1069.002"],"cves":[]},{"id":"9a132afa-654e-11eb-ae93-0242ac130002","title":"PUA - AdFind Suspicious Execution","author":"Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community","status":"test","level":"high","date":"2021-02-02","modified":"2025-10-24","description":"Detects AdFind execution with common flags seen used during attacks","references":["https://www.joeware.net/freetools/tools/adfind/","https://thedfirreport.com/2020/05/08/adfind-recon/","https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/","https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/","https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx","https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md","https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1087.002/T1087.002.md#atomic-test-7---adfind---enumerate-active-directory-user-objects"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1018","attack.t1087.002","attack.t1482","attack.t1069.002","stp.1u"],"path":"rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage.yml","techniques":["T1018","T1087.002","T1482","T1069.002"],"cves":[]},{"id":"aae1243f-d8af-40d8-ab20-33fc6d0c55bc","title":"Suspicious Use of PsLogList","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2021-12-18","modified":"2026-06-29","description":"Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs","references":["https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/","https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos","https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Sysinternals/PsLogList","https://twitter.com/EricaZelic/status/1614075109827874817"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1087","attack.t1087.001","attack.t1087.002"],"path":"rules/windows/process_creation/proc_creation_win_sysinternals_psloglist.yml","techniques":["T1087","T1087.001","T1087.002"],"cves":[]},{"id":"ab6bffca-beff-4baa-af11-6733f296d57a","title":"Potential AD User Enumeration From Non-Machine Account","author":"Maxime Thiebaut (@0xThiebaut)","status":"test","level":"medium","date":"2020-03-30","modified":"2022-11-08","description":"Detects read access to a domain user from a non-machine account","references":["https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf","http://www.stuffithoughtiknew.com/2019/02/detecting-bloodhound.html","https://learn.microsoft.com/en-us/windows/win32/adschema/attributes-all","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662"],"logsource":{"product":"windows","service":"security"},"tags":["attack.discovery","attack.t1087.002"],"path":"rules/windows/builtin/security/win_security_ad_user_enumeration.yml","techniques":["T1087.002"],"cves":[]},{"id":"d95de845-b83c-4a9a-8a6a-4fc802ebf6c0","title":"Suspicious Group And Account Reconnaissance Activity Using Net.EXE","author":"Florian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2019-01-16","modified":"2023-03-02","description":"Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE\nCheck if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM)\n","references":["https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/","https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/","https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1087.001","attack.t1087.002"],"path":"rules/windows/process_creation/proc_creation_win_net_groups_and_accounts_recon.yml","techniques":["T1087.001","T1087.002"],"cves":[]},{"id":"df55196f-f105-44d3-a675-e9dfb6cc2f2b","title":"Renamed AdFind Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-08-21","modified":"2025-02-26","description":"Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.","references":["https://www.joeware.net/freetools/tools/adfind/","https://thedfirreport.com/2020/05/08/adfind-recon/","https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/","https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/","https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx","https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1018","attack.t1087.002","attack.t1482","attack.t1069.002"],"path":"rules/windows/process_creation/proc_creation_win_renamed_adfind.yml","techniques":["T1018","T1087.002","T1482","T1069.002"],"cves":[]},{"id":"e5d36acd-acb4-4c6f-a13f-9eb203d50099","title":"Active Directory Structure Export Via Csvde.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-03-14","modified":null,"description":"Detects the execution of \"csvde.exe\" in order to export organizational Active Directory structure.","references":["https://www.cybereason.com/blog/research/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms","https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf","https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit","https://redcanary.com/blog/msix-installers/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.exfiltration","attack.discovery","attack.t1087.002"],"path":"rules/windows/process_creation/proc_creation_win_csvde_export.yml","techniques":["T1087.002"],"cves":[]},{"id":"ef61af62-bc74-4f58-b49b-626448227652","title":"Suspicious Active Directory Database Snapshot Via ADExplorer","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-03-14","modified":"2025-07-09","description":"Detects the execution of Sysinternals ADExplorer with the \"-snapshot\" flag in order to save a local copy of the active directory database to a suspicious directory. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.","references":["https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html","https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer","https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24","https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/","https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/","https://trustedsec.com/blog/adexplorer-on-engagements"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1087.002","attack.t1069.002","attack.t1482"],"path":"rules/windows/process_creation/proc_creation_win_sysinternals_adexplorer_susp_execution.yml","techniques":["T1087.002","T1069.002","T1482"],"cves":[]},{"id":"f376c8a7-a2d0-4ddc-aa0c-16c17236d962","title":"HackTool - Bloodhound/Sharphound Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-12-20","modified":"2023-02-04","description":"Detects command line parameters used by Bloodhound and Sharphound hack tools","references":["https://github.com/BloodHoundAD/BloodHound","https://github.com/BloodHoundAD/SharpHound"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1087.001","attack.t1087.002","attack.t1482","attack.t1069.001","attack.t1069.002","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_bloodhound_sharphound.yml","techniques":["T1087.001","T1087.002","T1482","T1069.001","T1069.002","T1059.001"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2023-32315","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2023-3519","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-44077","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2020-1472","state":"mapped","mapping_types":["primary_impact","secondary_impact"]},{"cveID":"CVE-2021-40539","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}