Query: detect Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment in logs
Matching passage: Sigma rule: Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment. Logsource: windows / process_creation. Rule: title: PUA - AdFind.EXE Execution id: 514e7e3e-b3b4-4a67-af60-be20f139198b related: - id: 455b9d50-15a1-4b99-853f-8d37655a4c1b type: similar status: experimental description: Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment references: - https://www.joeware.net/freetools/tools/adfind/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-26 tags: - attack.discovery - attack.t1087.002 logsource: product: windows category: process_creation detection: selection: - Image|endswith: \AdFind.exe - OriginalFileName: AdFind.exe - Hashes|contains: - IMPHASH=d144de8117df2beceaba2201ad304764 - IMPHASH=12ce1c0f3f5837ecc18a3782408fa975 - IMPHASH=bca5675746d13a1f246e2da3c2217492 - IMPHASH=4fbf3f084fbbb2470b80b2013134df35 - IMPHASH=49b639b4acbecc49d72a01f357aa4930 - IMPHASH=53e117a96057eaf19c41380d0e87f1c2 - IMPHASH=680dad9e300346e05a85023965867201 - IMPHASH=21aa085d54992511b9f115355e468782 condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_execution/info.yml
Near-miss passage: Sigma rule: Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute liv. Logsource: windows / process_creation. Rule: title: Python Inline Command Execution id: 899133d5-4d7c-4a7f-94ee-27355c879d90 status: test description: Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code. references: - https://docs.python.org/3/using/cmdline.html#cmdoption-c - https://www.revshells.com/ - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-02 modified: 2025-10-07 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: python.exe - Image|endswith: - python.exe - python3.exe - python2.exe selection_cli: CommandLine|contains: ' -c' filter_main_python_1: ParentImage|startswith: - C:\Program Files\Python - C:\Program Files (x86)\Python ParentImage|endswith: \python.exe ParentCommandLine|contains: -E -s -m ensurepip -U --default-pip filter_main_python_trace: ParentImage|startswith: - C:\Program Files\Python - C:\Program Files (x86)\Python CommandLine|contains|all: - -W ignore::DeprecationWarning - '[''install'', ''--no-cache-dir'', ''--no-index'', ''--find-links'',' - '''--upgrade'', ''pip''' filter_optional_vscode: - ParentImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe - ParentImage: - C:\Program Files\Microsoft VS Code\Code.exe - C:\Program Files (x86)\Microsoft VS Code\Code.exe filter_optional_pip: CommandLine|contains|all: - <pip-setuptools-caller> - exec(compile( condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Python libraries that use a flag starting with "-c". Filter according to your environment level: medium