Tool: AdFind

Description

[AdFind](https://attack.mitre.org/software/S0552) is a free command-line query tool that can be used for gathering information from Active Directory.(Citation: Red Canary Hospital Thwarted Ryuk October 2020)(Citation: FireEye FIN6 Apr 2019)(Citation: FireEye Ryuk and Trickbot January 2019)

External References

• mitre-attack
• Red Canary Hospital Thwarted Ryuk October 2020
• FireEye Ryuk and Trickbot January 2019
• FireEye FIN6 Apr 2019

Techniques Used by This Tool

• T1016 — System Network Configuration Discovery
• T1018 — Remote System Discovery
• T1069.002 — Domain Groups
• T1087.002 — Domain Account
• T1482 — Domain Trust Discovery

APT Groups Using This Tool

• Wizard Spider
• FIN7
• TA505
• Play
• FIN6
• APT29
• Akira
• menuPass
• INC Ransom
• BlackByte
• Lotus Blossom