Suspicious Active Directory Enumeration via AdFind.EXE

SigmaHQ Detections@sigmaHQ

•updated May 20, 2025•0•22

Detects Active Directory enumeration activity using the AdFind tool with specific command-line flags to discover password policies, enumerate Active Directory administrators, or enumerate Exchange AD objects. This activity is often associated with reconnaissance phases of an attack.