Sigma rule: PUA - AdFind Suspicious Execution

Rule

Title

PUA - AdFind Suspicious Execution

Status

test

Level

high

Author

Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community

Date

2021-02-02

Modified

2025-10-24

File

rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects AdFind execution with common flags seen used during attacks

Log source

product

windows

category

process_creation

Detection

selection:
    CommandLine|contains:
        - 'domainlist'
        - 'trustdmp'
        - 'dcmodes'
        - 'adinfo'
        - '-sc dclist'
        - 'computer_pwdnotreqd'
        - 'objectcategory='
        - '-subnets -f'
        - 'name="Domain Admins"'
        - '-sc u:'
        - 'domainncs'
        - 'dompol'
        - ' oudmp '
        - 'subnetdmp'
        - 'gpodmp'
        - 'fspdmp'
        - 'users_noexpire'
        - 'computers_active'
        - 'computers_pwdnotreqd'
condition: selection

False positives (as the rule lists them)

• Legitimate admin activity

Tags

• attack.discovery
• attack.t1018
• attack.t1087.002
• attack.t1482
• attack.t1069.002
• stp.1u

MITRE ATT&CK ids this rule names

• T1018
• T1069.002
• T1087.002
• T1482

Related rules

• 455b9d50-15a1-4b99-853f-8d37655a4c1b (similar)
• 75df3b17-8bcc-4565-b89b-c9898acef911 (obsolete)

References

• https://www.joeware.net/freetools/tools/adfind/
• https://thedfirreport.com/2020/05/08/adfind-recon/
• https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/
• https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
• https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
• https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md
• https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1087.002/T1087.002.md#atomic-test-7---adfind---enumerate-active-directory-user-objects

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage.yml