ADExplorer Execution (Windows Event Log)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Active Directory Explorer (AD Explorer) is a tool from the Sysinternals suite that allows users to view, search, and analyze objects within Active Directory to understand its structure, object properties, and security settings. A threat actor might leverage AD Explorer to gain detailed insights into the AD environment, such as identifying privileged user accounts and network resources, which can be exploited to escalate privileges or facilitate lateral movement within a network. This use case detects executions of ADExplorer .

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.003` OS Credential Dumping: NTDS `T1552.001` Unsecured Credentials: Credentials In Files

References

https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4648: A logon was attempted using explicit credentials.
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

id: '30662.54791'
title: ADExplorer Execution
description: Active Directory Explorer (AD Explorer) is a tool from the Sysinternals
  suite that allows users to view, search, and analyze objects within Active Directory
  to understand its structure, object properties, and security settings. A threat
  actor might leverage AD Explorer to gain detailed insights into the AD environment,
  such as identifying privileged user accounts and network resources, which can be
  exploited to escalate privileges or facilitate lateral movement within a network.
  This use case detects executions of ADExplorer .
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process OR TERM(EventCode=4648) OR "<EventID>4648<") "ADExplorer64.exe"
  OR "ADExplorer.exe" OR "ADExplorer" OR "AdExp" | regex process_name="(?i)ADExplorer(64)?|AdExp\.exe"
  | table _time, host, user, parent_process_name, process, process_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
- credential-access:unsecured credentials:credentials in files
technique_id:
- T1552.001
- T1003.003
data_category:
- Windows event logs
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process OR TERM(EventCode=4648) OR "<EventID>4648<") "ADExplorer64.exe" OR "ADExplorer.exe" OR "ADExplorer" OR "AdExp"

Stage 2: `regex`

| regex process_name="(?i)ADExplorer(64)?|AdExp\.exe"

Stage 3: `table`

| table _time, host, user, parent_process_name, process, process_*

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4648` corpus 5 (splunk 5) `4688` corpus 317 (splunk 283, kusto 33, elastic 1)	`field:"EventID" kind:eq`
`process_name`	regex_match	`"(?i)ADExplorer(64)?` `AdExp.exe"` corpus 3 (splunk 3)	`field:"process_name" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>4688<"`
1	`"<EventID>4648<"`
1	`"ADExplorer64.exe"`
1	`"ADExplorer.exe"`
1	`"ADExplorer"`
1	`"AdExp"`