ADFind
AdFind is a legitimate command-line Active Directory query utility from joeware.net that is frequently abused as a dual-use post-compromise reconnaissance tool in Windows enterprise environments. The provided content consistently associates it with Active Directory discovery, including enumeration of domain users, domain groups, organizational units, domain trusts, computers, and broader system/network configuration information. It is mapped to MITRE ATT&CK-style behaviors including Domain Account Discovery, Domain Trust Discovery, Permission Groups Discovery: Domain Groups, Remote System Discovery, and System Network Configuration Discovery.
The content shows AdFind being used by multiple threat actors and in numerous intrusion sets and ransomware operations as part of reconnaissance and lateral movement preparation. Specifically mentioned examples include APT29/NOBELIUM during the SolarWinds compromise, Dark Halo/UNC2452-related activity investigated by Volexity, UNC2447, Akira affiliates, BlackByte, Mustang Panda, Lotus Blossom, Wizard Spider, and actors involved in Egregor and Play intrusions. In these cases, attackers used AdFind to query domain controllers, enumerate remote systems and hostnames, identify domain users and groups, and map Active Directory environments.
A notable example in the content is Volexity’s reporting that attackers used a file named sqlceip.exe which appeared to be Microsoft SQL Server Telemetry Client but was actually a renamed copy of AdFind. Microsoft also noted use of renamed AdFind during SolarWinds-related post-compromise reconnaissance against domain controllers. These references indicate a common masquerading pattern in which AdFind is renamed to blend into victim environments.
The content does not describe AdFind as self-propagating malware or a malicious implant; rather, it is a legitimate administrative utility commonly repurposed by adversaries for discovery. High-confidence indicators directly mentioned include the executable names ADFind.exe and a renamed sample observed as sqlceip.exe.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The attacker also made use of a file called sqlceip.exe, which upon first glance might appear as the legitimate version of SQL Server Telemetry Client provided by Microsoft. However, Volexity determined this tool was actually a version of AdFind from joeware.net. AdFind is a command-line tool used for querying and extracting data from Active Directory.
The attacker also made use of a file called sqlceip.exe, which upon first glance might appear as the legitimate version of SQL Server Telemetry Client provided by Microsoft. However, Volexity determined this tool was actually a version of AdFind from joeware.net. AdFind is a command-line tool used for querying and extracting data from Active Directory.
AdFind has the ability to query Active Directory for computers.
...open-source and dual-use tools as used and/or customized by the actors: ... AdFind ...
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Stealth
2 techniques
Stealth
Discovery
10 techniques
Discovery
...collected Active Directory configuration (Domain Trust Discovery, T1482) and network information (System Network Configuration Discovery, T1016) via ADFind and netscanold.exe.
AdFind – A publicly available tool that is used to query Active Directory. It has legitimate uses but is widely used by attackers to help map a network.
Below is a basic example of how to use adfind.exe to pull user data... After obtaining a full list of users on the domain check for common weak passwords.
Attackers query directories to extract sensitive information such as user accounts, group memberships and permissions... Some common types of LDAP enumeration that are important to monitor include: Admin enumeration: Queries targeting administrative accounts and privileges
The first step in a Black Basta compromise usually involves executing a uniquely obfuscated version of the AdFind tool... -f objectcategory=computer -csv name cn OperatingSystem dNSHostName
Attackers query directories to extract sensitive information such as user accounts, group memberships and permissions... Some common types of LDAP enumeration that are important to monitor include: Admin enumeration... Service accounts enumeration...
AdFind can enumerate domain users. APT41 used built-in net commands to enumerate domain administrator users. BloodHound can collect information about domain users, including identification of domain admin accounts.
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Active Directory reconnaissance tool used to enumerate and query AD objects; leveraged post-compromise to map environments and identify targets for lateral movement.
Active Directory enumeration tool abused by Play/Balloonfly for discovery in victim environments prior to ransomware deployment.
Active Directory discovery tool used to enumerate directory objects/trusts to support targeting and lateral movement.
AdFind is a directory-querying tool used for Active Directory enumeration and network/domain discovery.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.