Suspicious Active Directory Database Snapshot Via ADExplorer
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database to a suspicious directory. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND (PROCESSNAME endswith "\ADExp.exe,\ADExplorer.exe,\ADExplorer64.exe,\ADExplorer64a.exe" OR ORIGINALFILENAME = "AdExp" OR MESSAGE = "Active Directory Editor" OR PRODUCT_NAME = "Sysinternals ADExplorer") AND COMMANDLINE contains "snapshot" AND COMMANDLINE contains "\Downloads\,\Users\Public\,\AppData\,\Windows\Temp" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Active Directory
Author
Nasreddine Bencherchali (Nextron Systems)
