MalCommands — ADFind

#					tactics	techniques	os

detail

Command Line

adfind -sc computers_pwdnotreqd

Description

Use ADFind to dump a list of computers where password is not required to authenticate in GPO.

Risk

High

Risk Reason

This activity should always be audited and should only be occurring from IT personnel, if that.

Fidelity

High

Fidelity Reason

This type of commandline activity is rare in most organizations.

Operating Systems

Windows

Killchain Phases

Actions on Objectives

References

TOOL DATA

Tool Name: adfind

Tool URL: http://www.joeware.net/freetools/tools/adfind/

Tool Description: ADFind is a tool developed to query Active Directory - it utilizes a mixture of ldapsearch, search.vbs, ldp, dsquery and dsget along with other features. It was developed prior to dsquery/dsget/etc by multiple years but adopts many of the same features. The tool is written in C++ and is often used in some form by cyber threats during the information gathering phase of a compromise.

Common Tool Locations

Varies

Common Tool Arguments

basedn - Base DN to search on - defaults to NC
filter - LDAP filter to use for query.
attr list - List of specific attributes to return, defaults to * set.
-h host:port - Host and port to use for a connection, defaults to 389 on default LDAP server.
-gc - Search the Global Catalog on port 3268
-p - Alternate port to connect on.
-s - Scope of search base.
-t - Timeout value for query, default of 120 seconds.
See http://www.joeware.net/freetools/tools/adfind/usage.htm for all arguments.

MITRE ATT&CK TECHNIQUES

Technique: T1018 - Remote System Discovery

URL: https://attack.mitre.org/techniques/T1018

Description: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097) or net view using [Net](https://attack.mitre.org/software/S0039). Adversaries may also analyze data from local host files (ex: C:\Windows\System32\Drivers\etc\hosts or /etc/hosts) or other passive means (such as local [Arp](https://attack.mitre.org/software/S0099) cache entries) in order to discover the presence of remote systems in an environment. Adversaries may also target discovery of network infrastructure as well as leverage [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands on network devices to gather detailed information about systems within a network.(Citation: US-CERT-TA18-106A)(Citation: CISA AR21-126A FIVEHANDS May 2021)

Tactics:

Discovery