AdFind

Adversary Tools · AdFind

· ToolS0552 · Dual-use Araç

Type

Tool

Techniques

Used By

12 groups

Platforms

Windows

Description

AdFind is a free command-line query tool that can be used for gathering information from Active Directory.(Citation: Red Canary Hospital Thwarted Ryuk October 2020)(Citation: FireEye FIN6 Apr 2019)(Citation: FireEye Ryuk and Trickbot January 2019)

Used By (12 threat groups)

G0016APT29 G1024Akira G1043BlackByte G0037FIN6 G0046FIN7 G1032INC Ransom G0030Lotus Blossom G0129Mustang Panda G1040Play G0092TA505 G0102Wizard Spider G0045menuPass

Techniques (5)

T1016System Network Configuration Discovery

discovery

T1018Remote System Discovery

discovery

T1069.002Domain Groups

discovery

T1087.002Domain Account

discovery

T1482Domain Trust Discovery

discovery

References

https://attack.mitre.org/software/S0552 https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html