Loading malware…
AdFind is a legitimate command-line utility for querying Microsoft Active Directory and other directory services. It is frequently abused after compromise for Active Directory reconnaissance, including enumeration of domain users, groups, computers, organizational units, domain trusts, and network configuration. AdFind has appeared in espionage, ransomware, and financially motivated intrusions involving actors and operations variously tracked as Earth Krahang, REF2924, Dark Halo/NOBELIUM, UNC2447, Andariel, and affiliates of ransomware families including Akira, BlackCat, Nefilim, NetWalker, ProLock, and Sodinokibi. Operators may rename the utility to masquerade as legitimate software. Its output can identify privileged accounts, domain relationships, and reachable systems that support subsequent credential theft and lateral movement. AdFind is principally used in Windows Active Directory enterprise environments.
11 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Along with TFirewall, we observed that the attacker used the free tool AdFind.
The attacker also made use of a file called sqlceip.exe, which upon first glance might appear as the legitimate version of SQL Server Telemetry Client provided by Microsoft. However, Volexity determined this tool was actually a version of AdFind from joeware.net. AdFind is a command-line tool used for querying and extracting data from Active Directory.
The attacker also made use of a file called sqlceip.exe, which upon first glance might appear as the legitimate version of SQL Server Telemetry Client provided by Microsoft. However, Volexity determined this tool was actually a version of AdFind from joeware.net. AdFind is a command-line tool used for querying and extracting data from Active Directory.
AdFind has the ability to query Active Directory for computers.
...open-source and dual-use tools as used and/or customized by the actors: ... AdFind ...
+5 more in the app. View in Mallory
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial.
Listed in the Earth Krahang resource-development TTP table.
BlackByte used AdFind during operations. Mustang Panda has utilized AdFind for enumerating domain groups, users, and computers. Lotus Blossom has used AdFind to query Active Directory in victim environments.
af.exe -f "objectcategory=computer" > ad_computers.txt
LockBit affiliates use SoftPerfect Network Scanner, Advanced IP Scanner, or Advanced Port Scanner to scan target networks.
“Tools like AdFind handle network and account discovery.”
AdFind is a command-line LDAP query tool abused by virtually every major IAB and ransomware operator for Active Directory enumeration.
Common initial discovery tools include Windows built-in utilities (net.exe, nltest.exe, systeminfo, ipconfig, whoami, etc)
Mustang Panda has utilized AdFind for enumerating domain groups, users, and computers.
AdFind ... was downloaded ... and used by the threat actor to enumerate domain users.
AdFind, a command-line tool for querying Active Directory, is used to locate domain controllers and gather information about the victim's environment.
The operators then started to copy the freeware tool ADFind.exe, which they used for discovery as well as for gathering domain configuration and organization information.
Once the operators gain foothold on a network, they used tools like Mimikatz and LaZagne to steal additional credentials and tools like BloodHound and ADFind to perform reconnaissance actions.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.