Detection rules › Splunk
ADExplorer Execution (Sysmon)
Active Directory Explorer (AD Explorer) is a tool from the Sysinternals suite that allows users to view, search, and analyze objects within Active Directory to understand its structure, object properties, and security settings. A threat actor might leverage AD Explorer to gain detailed insights into the AD environment, such as identifying privileged user accounts and network resources, which can be exploited to escalate privileges or facilitate lateral movement within a network. This use case detects executions of ADExplorer .
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
id: '30662.54790'
title: ADExplorer Execution
description: Active Directory Explorer (AD Explorer) is a tool from the Sysinternals
suite that allows users to view, search, and analyze objects within Active Directory
to understand its structure, object properties, and security settings. A threat
actor might leverage AD Explorer to gain detailed insights into the AD environment,
such as identifying privileged user accounts and network resources, which can be
exploited to escalate privileges or facilitate lateral movement within a network.
This use case detects executions of ADExplorer .
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
"ADExplorer64.exe" OR "ADExplorer.exe" OR "ADExplorer" OR "AdExp" | regex process_name="(?i)ADExplorer(64)?|AdExp\.exe"
| table _time, host, user, parent_process_name, process, process_* | bin span=1s
| stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
- credential-access:unsecured credentials:credentials in files
technique_id:
- T1552.001
- T1003.003
data_category:
- Windows Sysmon
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") "ADExplorer64.exe" OR "ADExplorer.exe" OR "ADExplorer" OR "AdExp"
Stage 2: regex
| regex process_name="(?i)ADExplorer(64)?|AdExp\.exe"
Stage 3: table
| table _time, host, user, parent_process_name, process, process_*
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"1" |
process_name | regex_match |
| field:"process_name" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>1<" |
| 1 | "ADExplorer64.exe" |
| 1 | "ADExplorer.exe" |
| 1 | "ADExplorer" |
| 1 | "AdExp" |