Detectionmediumexperimental

ADExplorer Writing Complete AD Snapshot Into .dat File

Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Arnim Rupp (Nextron Systems), Thomas PatzkeCreated Wed Jul 090a1255c5-d732-4b62-ac02-b5152d34fb83windows

Log Source

WindowsFile Event

ProductWindows← raw: windows

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection:
        Image|endswith:
            - '\ADExp.exe'
            - '\ADExplorer.exe'
            - '\ADExplorer64.exe'
            - '\ADExplorer64a.exe'
        TargetFilename|endswith: '.dat'
    condition: selection

False Positives

Legitimate use of ADExplorer by administrators creating .dat snapshots

References

MITRE ATT&CK

Tactics

TA0007 · Discovery

Techniques

T1482 · Domain Trust Discovery

Sub-techniques

T1087.002 · Domain Account T1069.002 · Domain Groups

Related Rules

SimilarDetectionmedium

Active Directory Database Snapshot Via ADExplorer

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

0a1255c5-d732-4b62-ac02-b5152d34fb83

Status

experimental

Level

medium

Type

Detection

Created

Wed Jul 09

Author

Arnim Rupp (Nextron Systems), Thomas Patzke

Path

rules/windows/file/file_event/file_event_win_sysinternals_adexplorer_dump_written.yml

Raw Tags

attack.discoveryattack.t1087.002attack.t1069.002attack.t1482

View on GitHub