ADRecon
ADRecon is an open-source PowerShell-based Active Directory reconnaissance tool used to gather extensive information about AD environments. The provided content states it can enumerate data including ACLs, DNS zones, BitLocker recovery keys, LAPS passwords, domain accounts, and SPN credential hashes. It is referenced as ADRecon, ADRecon.ps1, and in some intrusions under renamed script names such as dra.ps1 and C:\osit\r.ps1. Observed usage includes reconnaissance of Active Directory environments by multiple threat actors and intrusion sets, including UNC3944 / Octo Tempest / Scattered Spider-related activity, VOID MANTICORE, and BlackCat (ALPHV) intrusions or affiliates. In the cited incidents, ADRecon was used after initial access and during post-compromise discovery to enumerate the domain, support privilege escalation toward Domain Admin, and enable broader lateral movement or destructive actions. It has been observed alongside other AD enumeration tools such as ADExplorer, SharpHound, PingCastle, and ADFind, and alongside credential theft and defense evasion activity such as LSASS dumping, registry hive export, Windows Defender disabling, and use of Mimikatz. High-confidence indicators from the content include the tool name ADRecon, the PowerShell script name ADRecon.ps1, and renamed executions such as dra.ps1 and C:\osit\r.ps1.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
UNC3944 will also use network reconnaissance tools like ADRecon, ADExplorer, and SharpHound.
The file was identified as ‘ADRecon’, an open-source PowerShell tool specifically designed to gather extensive information about Active Directory (AD) environments, including ACLs, DNS zones, BitLocker recovery keys, LAPS passwords, Domain accounts, and SPN credential hashes.
VOID MANTICORE has utilized ADRecon to enumerate the active directory environment.
Techniques & procedures
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 technique
Execution
Stealth
1 technique
Stealth
Discovery
10 techniques
Discovery
Additional tradecraft and techniques: PingCastle and ADRecon to perform reconnaissance of Active Directory.
Initial bulk-export of users, groups, and device information is closely followed by enumerating data and resources readily available to the user’s profile... AAD bulk downloads of user, groups, and devices.
UNC3944 will also use network reconnaissance tools like ADRecon, ADExplorer, and SharpHound.
Attackers query directories to extract sensitive information such as user accounts, group memberships and permissions... Some common types of LDAP enumeration that are important to monitor include: Admin enumeration: Queries targeting administrative accounts and privileges
Later, the threat actor utilized a user account to remotely deploy Cobalt Strike Beacon on a server in a third domain, followed by network scans and enumeration of the Admins group in the new domain.
Upon initial compromise, UNC3944 is known to search for documentation on topics such as: user provisioning, MFA and/or device registration, network diagrams, and shared credentials in documents or spreadsheets.
The threat actor leveraged the SoftPerfect tool to perform several manual reconnaissance activities, which included searching for passwords in Group Policy xml files, accessing remote folders via Windows Explorer...
UNC3944 is known to search for documentation on topics such as: user provisioning, MFA and/or device registration...
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Active Directory reconnaissance tool used to enumerate the victim AD environment.
Active Directory reconnaissance tool used to enumerate AD environments and support privilege escalation and destructive operations.
PowerShell-based Active Directory reconnaissance framework used to enumerate domain information to support privilege escalation and follow-on destructive actions.
Active Directory reconnaissance framework used to enumerate sensitive AD configuration and credential-related data at scale.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.