Query: detect Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to e in logs
Matching passage: Sigma rule: Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to e. Logsource: windows / file_event. Rule: title: ADExplorer Writing Complete AD Snapshot Into .dat File id: 0a1255c5-d732-4b62-ac02-b5152d34fb83 related: - id: 9212f354-7775-4e28-9c9f-8f0a4544e664 type: similar status: experimental description: Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field. references: - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24 - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/ - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/ - https://trustedsec.com/blog/adexplorer-on-engagements author: Arnim Rupp (Nextron Systems), Thomas Patzke date: 2025-07-09 tags: - attack.discovery - attack.t1087.002 - attack.t1069.002 - attack.t1482 logsource: category: file_event product: windows detection: selection: Image|endswith: - \ADExp.exe - \ADExplorer.exe - \ADExplorer64.exe - \ADExplorer64a.exe TargetFilename|endswith: .dat condition: selection falsepositives: - Legitimate use of ADExplorer by administrators creating .dat snapshots level: medium
Near-miss passage: Sigma rule: Detects suspicious child process creations of VMware Tools process which may indicate persistence setup. Logsource: windows / process_creation. Rule: title: VMToolsd Suspicious Child Process id: 5687f942-867b-4578-ade7-1e341c46e99a status: test description: Detects suspicious child process creations of VMware Tools process which may indicate persistence setup references: - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/ - https://user-images.githubusercontent.com/61026070/136518004-b68cce7d-f9b8-4e9a-9b7b-53b1568a9a94.png - https://github.com/vmware/open-vm-tools/blob/master/open-vm-tools/tools.conf author: bohops, Bhabesh Raj date: 2021-10-08 modified: 2023-07-25 tags: - attack.execution - attack.persistence - attack.t1059 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \vmtoolsd.exe selection_img: - Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - OriginalFileName: - Cmd.Exe - cscript.exe - MSHTA.EXE - PowerShell.EXE - pwsh.dll - REGSVR32.EXE - RUNDLL32.EXE - wscript.exe filter_main_vmwaretools_script: Image|endswith: \cmd.exe CommandLine|contains: - \VMware\VMware Tools\poweron-vm-default.bat - \VMware\VMware Tools\poweroff-vm-default.bat - \VMware\VMware Tools\resume-vm-default.bat - \VMware\VMware Tools\suspend-vm-default.bat filter_main_empty: Image|endswith: \cmd.exe CommandLine: '' filter_main_null: Image|endswith: \cmd.exe CommandLine: null condition: all of selection* and not 1 of filter_main_* falsepositives: - Legitimate use by VM administrator level: high