PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE

Status: test
Severity: high
Log source: category process_creation, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Detects active directory enumeration activity using known AdFind CLI flags

Known false positives

Authorized administrative activity

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1087.002` Account Discovery: Domain Account

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE
id: 455b9d50-15a1-4b99-853f-8d37655a4c1b
related:
    - id: 9a132afa-654e-11eb-ae93-0242ac130002
      type: similar
    - id: 514e7e3e-b3b4-4a67-af60-be20f139198b
      type: similar
status: test
description: Detects active directory enumeration activity using known AdFind CLI flags
references:
    - https://www.joeware.net/freetools/tools/adfind/
    - https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md
author: frack113
date: 2021-12-13
modified: 2023-03-05
tags:
    - attack.discovery
    - attack.t1087.002
logsource:
    product: windows
    category: process_creation
detection:
    selection_password: # Listing password policy
        CommandLine|contains:
            - lockoutduration
            - lockoutthreshold
            - lockoutobservationwindow
            - maxpwdage
            - minpwdage
            - minpwdlength
            - pwdhistorylength
            - pwdproperties
    selection_enum_ad: # Enumerate Active Directory Admins
        CommandLine|contains: '-sc admincountdmp'
    selection_enum_exchange: # Enumerate Active Directory Exchange AD Objects
        CommandLine|contains: '-sc exchaddresses'
    condition: 1 of selection_*
falsepositives:
    - Authorized administrative activity
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_enumeration/info.yml

Stages and Predicates

Stage 0: `condition`

1 of selection_*

Stage 1: `selection_password`

selection_password:
    CommandLine|contains:
        - lockoutduration
        - lockoutthreshold
        - lockoutobservationwindow
        - maxpwdage
        - minpwdage
        - minpwdlength
        - pwdhistorylength
        - pwdproperties

Stage 2: `selection_enum_ad`

selection_enum_ad:
    CommandLine|contains: '-sc admincountdmp'

Stage 3: `selection_enum_exchange`

selection_enum_exchange:
    CommandLine|contains: '-sc exchaddresses'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-sc admincountdmp` `-sc exchaddresses` `lockoutduration` `lockoutobservationwindow` `lockoutthreshold` `maxpwdage` `minpwdage` `minpwdlength` `pwdhistorylength` `pwdproperties`	`field:"CommandLine" kind:match`

PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_password

Stage 2: selection_enum_ad

Stage 3: selection_enum_exchange

Indicators

Stage 0: `condition`

Stage 1: `selection_password`

Stage 2: `selection_enum_ad`

Stage 3: `selection_enum_exchange`