1. Home
  2. Software
  3. AdFind

AdFind

AdFind is a free command-line query tool that can be used for gathering information from Active Directory.[1][2][3]

ID: S0552
ⓘ
Type: TOOL
ⓘ
Platforms: Windows
Version: 1.5
Created: 28 December 2020
Last Modified: 25 September 2024
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1482 域信任发现

AdFind can gather information about organizational units (OUs) and domain trusts from Active Directory.[1][2][3][4]
Enterprise T1069 .002 权限组发现: Domain Groups

AdFind can enumerate domain groups.[1][2][3][4]
Enterprise T1016 系统网络配置发现

AdFind can extract subnet information from Active Directory.[1][2][3]
Enterprise T1087 .002 账号发现: Domain Account

AdFind can enumerate domain users.[1][2][3][5][4]
Enterprise T1018 远程系统发现

AdFind has the ability to query Active Directory for computers.[1][2][3][5]

Groups That Use This Software

ID Name References
G0092 TA505

[6]
G0102 Wizard Spider

[3][7][8][1][9]
G0046 FIN7

[10]
G1040 Play

[11][12]
G0037 FIN6

[2]
G1024 Akira

[13]
G1032 INC Ransom

[14]
G0016 APT29

[15][16][17][18][19][20]
G0045 menuPass

[21]

Campaigns

ID Name Description
C0015 C0015

[22]
C0024 SolarWinds Compromise

[15][16]

References

  1. Brian Donohue, Katie Nickels, Paul Michaud, Adina Bodkins, Taylor Chapman, Tony Lambert, Jeff Felling, Kyle Rainey, Mike Haag, Matt Graeber, Aaron Didier.. (2020, October 29). A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak. Retrieved October 30, 2020.
  2. McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019.
  3. Goody, K., et al (2019, January 11). A Nasty Trick: From Credential Theft Malware to Business Disruption. Retrieved May 12, 2020.
  4. Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.
  5. Cybereason. (2022, August 17). Bumblebee Loader – The High Road to Enterprise Domain Control. Retrieved August 29, 2022.
  6. Terefos, A. (2020, November 18). TA505: A Brief History of Their Time. Retrieved July 14, 2022.
  7. The DFIR Report. (2020, October 8). Ryuk’s Return. Retrieved October 9, 2020.
  8. The DFIR Report. (2020, November 5). Ryuk Speed Run, 2 Hours to Ransom. Retrieved November 6, 2020.
  9. Shilko, J., et al. (2021, October 7). FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets. Retrieved June 15, 2023.
  10. Loui, E. and Reynolds, J. (2021, August 30). CARBON SPIDER Embraces Big Game Hunting, Part 1. Retrieved September 20, 2021.
  11. CISA. (2023, December 18). #StopRansomware: Play Ransomware AA23-352A. Retrieved September 24, 2024.
  1. Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024.
  2. Steven Campbell, Akshay Suthar, & Connor Belfiorre. (2023, July 26). Conti and Akira: Chained Together. Retrieved February 20, 2024.
  3. Counter Threat Unit Research Team. (2024, April 15). GOLD IONIC DEPLOYS INC RANSOMWARE. Retrieved June 5, 2024.
  4. MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021.
  5. CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022.
  6. ESET. (2022, February). THREAT REPORT T3 2021. Retrieved February 10, 2022.
  7. NSA, FBI, DHS. (2021, April 15). Russian SVR Targets U.S. and Allied Networks. Retrieved April 16, 2021.
  8. UK NCSC. (2021, April 15). UK and US call out Russia for SolarWinds compromise. Retrieved April 16, 2021.
  9. Mandiant. (2020, April 27). Assembling the Russian Nesting Doll: UNC2452 Merged into APT29. Retrieved March 26, 2023.
  10. Symantec. (2020, November 17). Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign. Retrieved December 17, 2020.
  11. DFIR Report. (2021, November 29). CONTInuing the Bazar Ransomware Story. Retrieved September 29, 2022.