tool
AdFind is a free command-line query tool that can be used for gathering information from Active Directory.[1][2][3]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
23rd percentile · 77% of 825 ATT&CK software entries have more Enterprise techniques.
6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
83rd percentile · 83% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
98th percentile · 98% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
17th percentile · 83% of 825 ATT&CK software entries have more mitigations per technique.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this tool’s 5 Enterprise techniques.
Technique Campaign use over its cumulative rule count.
135 distinct rules cover the 5 techniques recorded for this tool. 82 Splunk · 53 Sigma.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory. | Generic | test | ps_script | windows | PowerShell | - | low | frack113 | 2022-03-17 | 2023-07-08 | 36bed6b2-e9a0-4fff-beeb-413a92b86138 | ||||
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-03-14 | 2025-07-09 | 9212f354-7775-4e28-9c9f-8f0a4544e664 | ||||
Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory | Generic | test | ps_script | windows | PowerShell | - | low | frack113 | 2022-03-17 | 2022-11-17 | 8c3a6607-b7dc-4f0d-a646-ef38c00b76ee | ||||
Detects the execution of "csvde.exe" in order to export organizational Active Directory structure. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-03-14 | — | e5d36acd-acb4-4c6f-a13f-9eb203d50099 | ||||
Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs | Generic | test | - | windows | WinEventLog Security | - | high | Samir Bousseaden | 2019-04-03 | 2022-07-13 | 35ba1d85-724d-42a3-889f-2e2362bcaf23 | ||||
Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. (...) | Generic | experimental | file_event | windows | Sysmon | - | medium | Arnim Rupp (Nextron Systems), Thomas Patzke | 2025-07-09 | — | 0a1255c5-d732-4b62-ac02-b5152d34fb83 | ||||
Splunk | The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for domain users. (...) | Generic | stable | ps_script | windows | PowerShell | - | medium | Teoderick Contreras, Mauricio Velazco, Splunk | 2021-08-25 | 2026-10-02 | de7fcadc-04f3-11ec-a241-acde48001122 | |||
Detects default file names outputted by the BloodHound collection tool SharpHound | Generic | test | file_event | windows | Sysmon | - | high | C.J. May | 2022-08-09 | 2026-02-19 | 02773bed-83bf-469f-b7ff-e676e7d78bab | ||||
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | high | Florian Roth (Nextron Systems), MSTI (query) | 2022-10-01 | — | fa3c117a-bc0d-416e-a31b-0c0e80653efb | |||||
Find information about network devices that is not stored in config files | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-12 | 2023-01-04 | 9705a6a1-6db6-4a16-a987-15b7151e299b | ||||
Splunk | This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...) | Anomaly | stable | network_device | - | Cisco IOS · Cisco | - | medium | Nasreddine Bencherchali | 2026-05-19 | 2026-05-20 | 71ac5328-2364-40cf-8381-92b8dc531399 | |||
Splunk | This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...) | Anomaly | stable | network_device | - | Cisco IOS · Cisco | - | medium | Nasreddine Bencherchali | 2026-05-19 | 2026-05-20 | efb20922-17bc-4fb0-880c-be50cfc100dd | |||
Splunk | This analytic identifies non-browser processes reaching out to public IP lookup or geolocation servi (...) | Anomaly | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Nasreddine Bencherchali, Splunk, Janantha Marasinghe | 2025-07-01 | 2026-09-22 | 568cb83e-d79e-4a23-85ec-6e1f6c30cb2f | |||
Splunk | The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 17e9b764-3a2b-4d36-9751-32d13ce4718b | |||
Splunk | The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 1f57f10e-1dc5-47ea-852c-2e85b2503d79 | |||
Splunk | The following analytic detects the execution of the `Invoke-AzureHound` command-line argument, commonly used by the AzureHound tool. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-06-03 | 2026-05-13 | 26f02e96-c300-11eb-b611-acde48001122 | |||
Splunk | The following analytic detects the creation of specific AzureHound-related files, such as `*-azurecollection.zip` and various `.json` files, on disk. (...) | Generic | stable | file_event | windows | Sysmon | - | medium | Michael Haag, Splunk | 2021-06-03 | 2026-05-13 | 1c34549e-c31b-11eb-996b-acde48001122 | |||
Splunk | The following analytic detects the execution of SharpHound command-line arguments, specifically `-collectionMethod` and `invoke-bloodhound`. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-06-03 | 2026-10-02 | a0bdd2f6-c2ff-11eb-b918-acde48001122 | |||
Splunk | The following analytic detects the creation of files typically associated with SharpHound, a reconnaissance tool used for gathering domain and trust data. (...) | Generic | stable | file_event | windows | Sysmon | - | medium | Michael Haag, Splunk | 2021-06-03 | 2026-10-02 | 42b4b438-beed-11eb-ba1d-acde48001122 | |||
Splunk | The following analytic detects the usage of the SharpHound binary by identifying its original filename, `SharpHound.exe`, and the process name. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-06-03 | 2026-10-02 | dd04b29a-beed-11eb-87bc-acde48001122 | |||
Enumerates Active Directory to determine computers that are joined to the domain | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2022-02-12 | — | 1f6399cf-2c80-4924-ace1-6fcff3393480 | ||||
Detects DNS server discovery via LDAP query requests from uncommon applications | Generic | test | dns | windows | Sysmon | - | low | frack113 | 2022-08-20 | 2023-09-18 | a21bcd7e-38ec-49ad-b69a-9ea17e69509e | ||||
Splunk | The following analytic identifies the execution of `dsquery.exe` with command-line arguments used to discover domain users. (...) | Anomaly | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Mauricio Velazco, Splunk | 2021-08-25 | 2026-05-13 | b1a8ce04-04c2-11ec-bea7-acde48001122 | |||
Splunk | The following analytic detects the execution of `wmic.exe` with command-line arguments used to query for domain users. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Mauricio Velazco, Splunk | 2021-08-25 | 2026-05-13 | 383572e0-04c5-11ec-bdcc-acde48001122 | |||
Splunk | The following analytic detects the execution of `nltest.exe` with command-line arguments `/dclist:` or `/dsgetdc:` to discover domain controllers. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Mauricio Velazco, Splunk | 2021-09-01 | 2026-07-20 | 41243735-89a7-4c83-bcdd-570aa78f00a1 | |||
Splunk | The following analytic identifies the execution of `wmic.exe` with command-line arguments used to discover domain controllers in a Windows domain. (...) | Hunting | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Mauricio Velazco, Splunk | 2021-09-01 | 2026-05-13 | 64c7adaa-48ee-483c-b0d6-7175bc65e6cc | |||
Splunk | The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for domain groups. (...) | Generic | stable | ps_script | windows | PowerShell | - | medium | Mauricio Velazco, Splunk | 2021-08-27 | 2026-10-02 | 089c862f-5f83-49b5-b1c8-7e4ff66560c7 | |||
Splunk | The following analytic identifies the execution of `dsquery.exe` with command-line arguments used to query for domain groups. (...) | Anomaly | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Mauricio Velazco, Splunk | 2021-08-26 | 2026-05-13 | f0c9d62f-a232-4edd-b17e-bc409fb133d4 | |||
Splunk | The following analytic identifies the execution of `wmic.exe` with command-line arguments used to query for domain groups. (...) | Hunting | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Mauricio Velazco, Splunk | 2021-08-26 | 2026-05-13 | a87736a6-95cd-4728-8689-3c64d5026b3e | |||
Detects execution of "dsquery.exe" for domain trust discovery | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | E.M. Anhaus, Tony Lambert, oscd.community, omkar72 | 2019-10-24 | 2023-02-02 | 3bad990e-4848-4a78-9530-b427d854aac0 | ||||
Domain user and group enumeration via network reconnaissance. (...) | Unsupported | unsupported | - | - | DCE/RPC · Zeek | - | medium | Nate Guagenti (@neu5ron), Open Threat Research (OTR) | 2020-05-03 | 2023-03-24 | 66a0bdc6-ee04-441a-9125-99d2eb547942 | ||||
Splunk | The following analytic detects the execution of "dsquery.exe" with arguments targeting `TrustedDomain` queries directly from the command line. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-03-31 | 2026-10-02 | cc316032-924a-11eb-91a2-acde48001122 | |||
Splunk | The following analytic detects the execution of the `Get-DomainGroupMember` cmdlet from PowerView, identified through PowerShell Script Block Logging (EventCode=4104). (...) | Hunting | stable | ps_script | windows | PowerShell | - | medium | Mauricio Velazco, Splunk | 2021-08-27 | 2026-05-13 | 10d62950-0de5-4199-a710-cff9ea79b413 | |||
Splunk | The following analytic detects the execution of `wmic.exe` with command-line arguments querying specific elevated domain groups. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Mauricio Velazco, Splunk | 2021-08-26 | 2026-05-13 | 3f6bbf22-093e-4cb4-9641-83f47b8444b6 | |||
Detects enumeration of the global catalog (that can be performed using BloodHound or others AD reconnaissance tools). (...) | Unsupported | unsupported | network_connection | windows | WinEventLog Security | - | medium | Chakib Gzenayi (@Chak092), Hosni Mribah | 2020-05-11 | 2023-02-24 | 619b020f-0fd7-4f23-87db-3f51ef837a34 | ||||
Adversaries may look for details about the network configuration and settings of systems they access (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' | 2021-12-07 | 2025-10-18 | 0e4164da-94bc-450d-a7be-a4b176179f1f | ||||
Splunk | The following analytic detects the execution of `powershell.exe` with command-line arguments used to enumerate domain users via the `Get-ADUser` cmdlet. (...) | Hunting | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Mauricio Velazco, Splunk | 2021-08-25 | 2026-10-02 | 0b6ee3f4-04e3-11ec-a87d-acde48001122 | |||
Splunk | The following analytic detects the execution of the `Get-AdUser` PowerShell cmdlet, which is used to enumerate all domain users. (...) | Hunting | stable | ps_script | windows | PowerShell | - | medium | Teoderick Contreras, Mauricio Velazco, Splunk | 2021-08-25 | 2026-10-02 | 21432e40-04f4-11ec-b7e6-acde48001122 | |||
Splunk | The following analytic detects the execution of `powershell.exe` with command-line arguments used to enumerate domain users via the `Get-DomainUser` command. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Mauricio Velazco, Splunk | 2021-08-25 | 2026-10-02 | 9a5a41d6-04e7-11ec-923c-acde48001122 | |||
Splunk | The following analytic detects the execution of the `Get-DomainUser` cmdlet using PowerShell Script Block Logging (EventCode=4104). (...) | Generic | stable | ps_script | windows | PowerShell | - | medium | Teoderick Contreras, Mauricio Velazco, Splunk | 2021-08-25 | 2026-05-13 | 61994268-04f4-11ec-865c-acde48001122 | |||
Splunk | The following analytic identifies the execution of the Get-DomainTrust command from PowerView using PowerShell, which is used to gather domain trust information. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-09-02 | 2026-10-02 | 4fa7f846-054a-11ec-a836-acde48001122 | |||
Splunk | The following analytic detects the execution of the Get-DomainTrust command from PowerView using PowerShell Script Block Logging (EventCode=4104). (...) | Generic | stable | ps_script | windows | PowerShell | - | medium | Michael Haag, Splunk | 2021-09-02 | 2026-05-13 | 89275e7e-0548-11ec-bf75-acde48001122 | |||
Splunk | The following analytic detects the execution of the Get-ForestTrust command via PowerShell, commonly used by adversaries to gather domain trust information. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-09-02 | 2026-10-02 | 584f4884-0bf1-11ec-a5ec-acde48001122 | |||
Splunk | The following analytic detects the execution of the Get-ForestTrust command from PowerSploit using PowerShell Script Block Logging (EventCode=4104). (...) | Generic | stable | ps_script | windows | PowerShell | - | medium | Michael Haag, Splunk | 2021-09-02 | 2026-05-13 | 70fac80e-0bf1-11ec-9ba0-acde48001122 | |||
Splunk | The following analytic detects the execution of `powershell.exe` with the `Get-AdComputer` commandlet, which is used to discover remote systems within a domain. (...) | Hunting | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Mauricio Velazco, Splunk | 2021-09-01 | 2026-05-13 | c5a31f80-5888-4d81-9f78-1cc65026316e | |||
Splunk | The following analytic detects the execution of the `Get-AdComputer` PowerShell commandlet using PowerShell Script Block Logging (EventCode=4104). (...) | Hunting | stable | ps_script | windows | PowerShell | - | medium | Mauricio Velazco, Splunk | 2021-09-01 | 2026-10-02 | a9a1da02-8e27-4bf7-a348-f4389c9da487 | |||
Splunk | The following analytic detects the execution of `powershell.exe` with the `Get-AdGroup` commandlet, which is used to query domain groups in a Windows Domain. (...) | Hunting | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Mauricio Velazco, Splunk | 2021-08-26 | 2026-10-02 | 872e3063-0fc4-4e68-b2f3-f2b99184a708 | |||
Splunk | The following analytic detects the execution of the `Get-AdGroup` PowerShell cmdlet using PowerShell Script Block Logging (EventCode=4104). (...) | Hunting | stable | ps_script | windows | PowerShell | - | medium | Mauricio Velazco, Splunk | 2021-08-27 | 2026-10-02 | e4c73d68-794b-468d-b4d0-dac1772bbae7 | |||
Splunk | The following analytic detects the execution of `powershell.exe` with command-line arguments that utilize `Get-DomainComputer` to discover remote systems. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Mauricio Velazco, Splunk | 2021-09-01 | 2026-05-13 | ed550c19-712e-43f6-bd19-6f58f61b3a5e | |||
Splunk | The following analytic detects the execution of the `Get-DomainComputer` commandlet using PowerShell Script Block Logging (EventCode=4104). (...) | Generic | stable | ps_script | windows | PowerShell | - | medium | Mauricio Velazco, Splunk | 2021-09-01 | 2026-05-13 | f64da023-b988-4775-8d57-38e512beb56e |