ATT&CKSoftwareAdFind

AdFind

S0552

Tool.View on attack.mitre.org

About this tool

AdFind is a free command-line query tool that can be used for gathering information from Active Directory.

Techniques used5

Discovery5

T1016System Network Configuration DiscoveryT1018Remote System DiscoveryT1069.002Domain GroupsT1087.002Domain AccountT1482Domain Trust Discovery

Procedure examples5

TechniqueProcedure example
T1016
System Network Configuration Discovery

AdFind can extract subnet information from Active Directory.

FireEye FIN6 Apr 2019FireEye Ryuk and Trickbot January 2019Red Canary Hospital Thwarted Ryuk October 2020
T1018
Remote System Discovery

AdFind has the ability to query Active Directory for computers.

Cybereason Bumblebee August 2022FireEye FIN6 Apr 2019FireEye Ryuk and Trickbot January 2019Red Canary Hospital Thwarted Ryuk October 2020
T1069.002
Domain Groups

AdFind can enumerate domain groups.

FireEye FIN6 Apr 2019FireEye Ryuk and Trickbot January 2019Red Canary Hospital Thwarted Ryuk October 2020Symantec Bumblebee June 2022
T1087.002
Domain Account

AdFind can enumerate domain users.

Cybereason Bumblebee August 2022FireEye FIN6 Apr 2019FireEye Ryuk and Trickbot January 2019Red Canary Hospital Thwarted Ryuk October 2020Symantec Bumblebee June 2022
T1482
Domain Trust Discovery

AdFind can gather information about organizational units (OUs) and domain trusts from Active Directory.

FireEye FIN6 Apr 2019FireEye Ryuk and Trickbot January 2019Red Canary Hospital Thwarted Ryuk October 2020Symantec Bumblebee June 2022

Groups that use it12

AkiraAPT29BlackByteFIN6FIN7INC RansomLotus BlossommenuPassMustang PandaPlayTA505Wizard Spider

Campaigns2

C0015SolarWinds Compromise

References3

  1. FireEye FIN6 Apr 2019 Open source
    McKeague, B. et al. (2019, April 5). Pick-Six: Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware. Retrieved April 17, 2019.
  2. FireEye Ryuk and Trickbot January 2019 Open source
    Goody, K., et al (2019, January 11). A Nasty Trick: From Credential Theft Malware to Business Disruption. Retrieved May 12, 2020.
  3. Red Canary Hospital Thwarted Ryuk October 2020 Open source
    Brian Donohue, Katie Nickels, Paul Michaud, Adina Bodkins, Taylor Chapman, Tony Lambert, Jeff Felling, Kyle Rainey, Mike Haag, Matt Graeber, Aaron Didier.. (2020, October 29). A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak. Retrieved October 30, 2020.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.

© 2026 DetectionCode Website. All Rights Reserved.

Developed by Taher Gabr · LinkedIn