Anvilogic low experimental other

Adfind Execution [snowflake-crowdstrikefdr_process]

AdFind is a free command-line query tool that can be used for gathering information from Active Directory. This use case looks for process executions of Adfind. -- Threat Actor Association: APT29/Nobelium/Cozy Bear, APT31, BlackMatter, Conti, DarkSide, FIN6, FIN7, FIN12, Karakurt, Lazarus, Traveling Spider, Wizard Spider, Yanluowang - Software Association: ALPHV/BlackCat, BazarLoader, Conti, Dridex, Entropy, Lockbit, Nefilim, Quantum, Sodinokibi/REvil - Atomics T1016 Test #6 Atomics T1018 Test#10 Atomics T1018 Test#11 Atomics T1069.002 Test #8 Atomics T1087.002 Test #5 Atomics T1087.002 Test #6 Atomics T1087.002 Test #7 Atomics T1087.002 Test #8

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform = 'Win' and process ilike '%adfind%'

Field Validations

Loading…

Comments (0)

Loading comments...