Query: Sigma rule for Detects AdFind execution with common flags seen used during attacks
Matching passage: Sigma rule: Detects AdFind execution with common flags seen used during attacks. Logsource: windows / process_creation. Rule: title: PUA - AdFind Suspicious Execution id: 9a132afa-654e-11eb-ae93-0242ac130002 related: - id: 455b9d50-15a1-4b99-853f-8d37655a4c1b type: similar - id: 75df3b17-8bcc-4565-b89b-c9898acef911 type: obsolete status: test description: Detects AdFind execution with common flags seen used during attacks references: - https://www.joeware.net/freetools/tools/adfind/ - https://thedfirreport.com/2020/05/08/adfind-recon/ - https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/ - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ - https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx - https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1087.002/T1087.002.md#atomic-test-7---adfind---enumerate-active-directory-user-objects author: Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community date: 2021-02-02 modified: 2025-10-24 tags: - attack.discovery - attack.t1018 - attack.t1087.002 - attack.t1482 - attack.t1069.002 - stp.1u logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - domainlist - trustdmp - dcmodes - adinfo - -sc dclist - computer_pwdnotreqd - objectcategory= - -subnets -f - name="Domain Admins" - '-sc u:' - domainncs - dompol - ' oudmp ' - subnetdmp - gpodmp - fspdmp - users_noexpire - computers_active - computers_pwdnotreqd condition: selection falsepositives: - Legitimate admin activity level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage/info.yml simulation: - type: atomic-red-team name: Adfind - Enumerate Active Directory Computer Objects technique: T1018 atomic_guid: a889f5be-2d54-4050-bd05-884578748bb4 - type: atomic-red-team name: Adfind - Enumerate Active Directory Domain Controller Objects technique: T1018 atomic_guid: 5838c31e-a0e2-4b9f-b60a-d79d2cb7995e
Near-miss passage: Sigma rule: Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Prope. Logsource: azure / auditlogs. Rule: title: CA Policy Updated by Non Approved Actor id: 50a3c7aa-ec29-44a4-92c1-fce229eef6fc status: test description: Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access author: Corissa Koopmans, '@corissalea' date: 2022-07-19 modified: 2024-05-28 tags: - attack.privilege-escalation - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1548 - attack.t1556 logsource: product: azure service: auditlogs detection: selection: properties.message: Update conditional access policy condition: selection falsepositives: - Misconfigured role permissions - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. level: medium