PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE

Title: PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE
Status: test
Description:Detects active directory enumeration activity using known AdFind CLI flags
References:
  -https://www.joeware.net/freetools/tools/adfind/
  -https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md
Author: frack113
Date: 2021-12-13
modified:2023-03-05
Tags:

• -'attack.discovery'
• -'attack.t1087.002'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_password:
    CommandLine|contains:
      -'lockoutduration'
      -'lockoutthreshold'
      -'lockoutobservationwindow'
      -'maxpwdage'
      -'minpwdage'
      -'minpwdlength'
      -'pwdhistorylength'
      -'pwdproperties'

  selection_enum_ad:
    CommandLine|contains: '-sc admincountdmp'
  selection_enum_exchange:
    CommandLine|contains: '-sc exchaddresses'
  condition:1 of selection_*
Falsepositives:
  -Authorized administrative activity
Level: high