Loading malware…
AdFind is a legitimate command-line Active Directory query utility developed for Windows environments and widely abused as a dual-use reconnaissance tool during enterprise intrusions. It is commonly used to enumerate domain users, groups, computers, organizational units, trusts, and related directory information from Active Directory, helping operators map victim environments and identify assets and privileged relationships for follow-on activity.
The tool is frequently observed in ransomware and post-compromise operations as part of discovery prior to credential theft, privilege escalation, lateral movement, or data theft. Reported use includes reconnaissance by ransomware affiliates and intrusion clusters associated with families and operations such as Nefilim, NetWalker, ProLock, Sodinokibi, Akira, BlackCat-related intrusions, Egregor activity, Play intrusions, UNC2447 activity, and the SolarWinds/NOBELIUM campaign. In several cases, operators renamed the binary to masquerade as benign software while querying domain controllers and other Active Directory infrastructure.
AdFind’s documented behaviors align with domain account discovery, domain group discovery, domain trust discovery, remote system discovery, and system network configuration discovery. It is typically executed after initial compromise rather than serving as a payload for persistence or impact. Because it is legitimate administrative software, its malicious significance depends heavily on execution context, surrounding tooling, and operator objectives rather than on the binary alone.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The attacker also made use of a file called sqlceip.exe, which upon first glance might appear as the legitimate version of SQL Server Telemetry Client provided by Microsoft. However, Volexity determined this tool was actually a version of AdFind from joeware.net. AdFind is a command-line tool used for querying and extracting data from Active Directory.
The attacker also made use of a file called sqlceip.exe, which upon first glance might appear as the legitimate version of SQL Server Telemetry Client provided by Microsoft. However, Volexity determined this tool was actually a version of AdFind from joeware.net. AdFind is a command-line tool used for querying and extracting data from Active Directory.
AdFind has the ability to query Active Directory for computers.
...open-source and dual-use tools as used and/or customized by the actors: ... AdFind ...
12 distinct techniques documented for this family, organized by ATT&CK tactic.
BlackByte used AdFind during operations. Mustang Panda has utilized AdFind for enumerating domain groups, users, and computers. Lotus Blossom has used AdFind to query Active Directory in victim environments.
adfind.exe -f "objectcategory=computer" > ad_computers.txt | approximately two minutes after Cobalt Strike activity started, a tool to enumerate an AD environment appeared on the infected host at C:\ProgramData\AdFind.exe
Le mode opératoire scanne le réseau pour collecter plus d’informations sur le SI et découvrir des services vulnérables.
T1069.002 - Permission Groups Discovery: Domain Trusts Water Ouroboros further uses AdFind to enumerate domain trusts and organizational units.
Common initial discovery tools include Windows built-in utilities (net.exe, nltest.exe, systeminfo, ipconfig, whoami, etc)
These commands reveal the users, computers, file shares and other information from a targeted AD environment.
Mustang Panda has utilized AdFind for enumerating domain groups, users, and computers.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Active Directory reconnaissance tool used to enumerate and query AD objects; leveraged post-compromise to map environments and identify targets for lateral movement.
Active Directory enumeration tool abused by Play/Balloonfly for discovery in victim environments prior to ransomware deployment.
Active Directory discovery tool used to enumerate directory objects/trusts to support targeting and lateral movement.
AdFind is a directory-querying tool used for Active Directory enumeration and network/domain discovery.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.