PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE

About the rule

Rule Type

Standard

Rule Description

Detects use of the AdFind tool performing Active Directory enumeration with CLI flags targeting sensitive domain attributes and account policies, potentially indicating reconnaissance activity by attackers.

Severity

Trouble

Rule journey

Attack chain scenario

Discovery: Account Discovery - Domain Account (T1087.002)

Impact

Exposure of critical Active Directory and account configuration information, which may facilitate privilege escalation and lateral movement for adversaries.

Rule Requirement

Prerequisites

Using Windows Event Viewer

1. Open GPMC (gpmc.msc).
2. Edit/Create GPO > Go to:
   Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Detailed Tracking
3. Enable:
   • Audit Process Creation → Success
   • Audit Process Termination → Success
4. For command-line tracking:
   Computer Configuration > Administrative Templates > System > Audit Process Creation
   Enable Include command line in process creation events.
5. Add registry key:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-Security-Auditing\Operational

Using Sysmon

1. Download Sysmon.
2. Open admin Command Prompt.
3. Install with config:
   sysmon.exe -i config.xml
4. Config sample:
5. xml
6. CopyEdit
7. <Sysmon>
   <EventFiltering>
   <ProcessCreate onmatch="exclude"/>
   </EventFiltering>
   </Sysmon>
8. Add registry key:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Microsoft-Windows-Sysmon\Operational

Criteria

Detection

Execution Mode

realtime

Log Sources

Active Directory

MITRE ATT&CK

T1087.002: Account Discovery - Domain Account

Security Standards

• Configure Operating System to prevent enumeration of administrator accounts during elevation (disable registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators).
• Implement Group Policy to disable enumeration of admin accounts on elevation.

Author

frack113

Future actions

Known False Positives

Authorized administrative and IT operations performing legitimate AD enumerations.

Next Steps

• Review flagged AdFind command executions for legitimacy.
• Monitor for patterns indicative of unauthorized AD reconnaissance.
• Harden UAC settings and account enumeration policies.
• Train administrators on secure enumeration practices and monitoring.

Mitigation

_______________________________________________________________________________