{"id":"T1069.002","name":"Domain Groups","url":"https://attack.mitre.org/techniques/T1069/002","tactics":["discovery"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0360","stix_id":"x-mitre-detection-strategy--69f22425-2ebb-4f3c-ab4d-fb9c6645f2f7","name":"Behavioral Detection of Domain Group Discovery","url":"https://attack.mitre.org/detectionstrategies/DET0360","analytics":[{"id":"AN1025","stix_id":"x-mitre-analytic--2385f397-5d17-4b37-ba07-bb52a52ff66c","name":"Analytic 1025","description":"Detection of domain group enumeration through command-line utilities such as 'net group /domain' or PowerShell cmdlets, followed by suspicious access to API calls or LSASS memory.","url":"https://attack.mitre.org/detectionstrategies/DET0360#AN1025","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"}],"mutable_elements":[{"field":"TimeWindow","description":"Adjustable window to track chained discovery activity (e.g., 5-10 minutes)."},{"field":"UserContext","description":"Tune to focus on non-admin users or service accounts performing enumeration."},{"field":"ProcessLineageDepth","description":"How far back the parent-child process chain is correlated."}],"live":true,"detection_strategies":["DET0360"],"techniques":["T1069.002"]},{"id":"AN1026","stix_id":"x-mitre-analytic--3415a6fa-a447-42f3-8155-68cf5d7cbcb3","name":"Analytic 1026","description":"Behavioral detection of domain group enumeration via ldapsearch or custom scripts leveraging LDAP over the network.","url":"https://attack.mitre.org/detectionstrategies/DET0360#AN1026","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"sshd logs","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"linux-syslog"},{"name":"NSM:Flow","channel":"ldap.log","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"LDAPQueryDepth","description":"Tunable based on number of LDAP queries before flagging suspicious behavior."},{"field":"CommandPattern","description":"Pattern matching against common ldapsearch or shell enumeration flags."}],"live":true,"detection_strategies":["DET0360"],"techniques":["T1069.002"]},{"id":"AN1027","stix_id":"x-mitre-analytic--23fa40ac-79d0-400a-a017-8e06cfc67e6c","name":"Analytic 1027","description":"Enumeration of domain groups using dscacheutil or dscl commands, often following initial login or domain trust queries.","url":"https://attack.mitre.org/detectionstrategies/DET0360#AN1027","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process events","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"CommandSignatureThreshold","description":"Defines how strictly command patterns must match known enumeration syntax."},{"field":"TimeWindow","description":"Adjustable window to correlate chained behavior such as group enumeration followed by user targeting."}],"live":true,"detection_strategies":["DET0360"],"techniques":["T1069.002"]}],"live":true,"version":"1.0","techniques":["T1069.002"]}],"sigma_rules":[{"id":"02030f2f-6199-49ec-b258-ea71b07e03dc","title":"Malicious PowerShell Commandlets - ProcessCreation","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-01-02","modified":"2025-12-10","description":"Detects Commandlet names from well-known PowerShell exploitation frameworks","references":["https://adsecurity.org/?p=2921","https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries","https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1","https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1","https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1","https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1","https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/","https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/","https://github.com/calebstewart/CVE-2021-1675","https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1","https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html","https://github.com/HarmJ0y/DAMP","https://github.com/samratashok/nishang","https://github.com/DarkCoderSc/PowerRunAsSystem/","https://github.com/besimorhino/powercat","https://github.com/Kevin-Robertson/Powermad","https://github.com/adrecon/ADRecon","https://github.com/adrecon/AzureADRecon","https://github.com/sadshade/veeam-creds/blob/6010eaf31ba41011b58d6af3950cffbf6f5cea32/Veeam-Get-Creds.ps1","https://github.com/The-Viper-One/Invoke-PowerDPAPI/","https://github.com/Arno0x/DNSExfiltrator/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.discovery","attack.t1482","attack.t1087","attack.t1087.001","attack.t1087.002","attack.t1069.001","attack.t1069.002","attack.t1069","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_malicious_cmdlets.yml","techniques":["T1482","T1087","T1087.001","T1087.002","T1069.001","T1069.002","T1069","T1059.001"],"cves":[]},{"id":"02773bed-83bf-469f-b7ff-e676e7d78bab","title":"BloodHound Collection Files","author":"C.J. May","status":"test","level":"high","date":"2022-08-09","modified":"2026-02-19","description":"Detects default file names outputted by the BloodHound collection tool SharpHound","references":["https://academy.hackthebox.com/course/preview/active-directory-bloodhound/bloodhound--data-collection"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.discovery","attack.t1087.001","attack.t1087.002","attack.t1482","attack.t1069.001","attack.t1069.002","attack.execution","attack.t1059.001"],"path":"rules/windows/file/file_event/file_event_win_bloodhound_collection.yml","techniques":["T1087.001","T1087.002","T1482","T1069.001","T1069.002","T1059.001"],"cves":[]},{"id":"0a1255c5-d732-4b62-ac02-b5152d34fb83","title":"ADExplorer Writing Complete AD Snapshot Into .dat File","author":"Arnim Rupp (Nextron Systems), Thomas Patzke","status":"experimental","level":"medium","date":"2025-07-09","modified":null,"description":"Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.","references":["https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer","https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24","https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/","https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/","https://trustedsec.com/blog/adexplorer-on-engagements"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.discovery","attack.t1087.002","attack.t1069.002","attack.t1482"],"path":"rules/windows/file/file_event/file_event_win_sysinternals_adexplorer_dump_written.yml","techniques":["T1087.002","T1069.002","T1482"],"cves":[]},{"id":"183e7ea8-ac4b-4c23-9aec-b3dac4e401ac","title":"Net.EXE Execution","author":"Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)","status":"test","level":"low","date":"2019-01-16","modified":"2022-07-11","description":"Detects execution of \"Net.EXE\".","references":["https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/","https://eqllib.readthedocs.io/en/latest/analytics/4d2e7fc1-af0b-4915-89aa-03d25ba7805e.html","https://eqllib.readthedocs.io/en/latest/analytics/e61f557c-a9d0-4c25-ab5b-bbc46bb24deb.html","https://eqllib.readthedocs.io/en/latest/analytics/9b3dd402-891c-4c4d-a662-28947168ce61.html","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1007/T1007.md#atomic-test-2---system-service-discovery---netexe"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1007","attack.t1049","attack.t1018","attack.t1135","attack.t1201","attack.t1069.001","attack.t1069.002","attack.t1087.001","attack.t1087.002","attack.lateral-movement","attack.t1021.002","attack.s0039","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_net_execution.yml","techniques":["T1007","T1049","T1018","T1135","T1201","T1069.001","T1069.002","T1087.001","T1087.002","T1021.002"],"cves":[]},{"id":"31d68132-4038-47c7-8f8e-635a39a7c174","title":"Potential Active Directory Reconnaissance/Enumeration Via LDAP","author":"Adeem Mawani","status":"test","level":"medium","date":"2021-06-22","modified":"2025-07-04","description":"Detects potential Active Directory enumeration via LDAP","references":["https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726","https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1","https://github.com/BloodHoundAD/SharpHound3/blob/7d96b991b1887ff50349ce59c80980bc0d95c86a/SharpHound3/LdapBuilder.cs","https://medium.com/falconforce/falconfriday-detecting-active-directory-data-collection-0xff21-c22d1a57494c","https://github.com/fox-it/BloodHound.py/blob/d65eb614831cd30f26028ccb072f5e77ca287e0b/bloodhound/ad/domain.py#L427","https://ipurple.team/2024/07/15/sharphound-detection/"],"logsource":{"product":"windows","service":"ldap"},"tags":["attack.discovery","attack.t1069.002","attack.t1087.002","attack.t1482"],"path":"rules/windows/builtin/ldap/win_ldap_recon.yml","techniques":["T1069.002","T1087.002","T1482"],"cves":[]},{"id":"7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c","title":"Malicious PowerShell Commandlets - PoshModule","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-01-20","modified":"2025-12-10","description":"Detects Commandlet names from well-known PowerShell exploitation frameworks","references":["https://adsecurity.org/?p=2921","https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries","https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1","https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1","https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1","https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1","https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/","https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/","https://github.com/calebstewart/CVE-2021-1675","https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1","https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html","https://github.com/HarmJ0y/DAMP","https://github.com/samratashok/nishang","https://github.com/DarkCoderSc/PowerRunAsSystem/","https://github.com/besimorhino/powercat","https://github.com/Kevin-Robertson/Powermad","https://github.com/adrecon/ADRecon","https://github.com/adrecon/AzureADRecon","https://github.com/sadshade/veeam-creds/blob/6010eaf31ba41011b58d6af3950cffbf6f5cea32/Veeam-Get-Creds.ps1","https://github.com/The-Viper-One/Invoke-PowerDPAPI/","https://github.com/Arno0x/DNSExfiltrator/"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.execution","attack.discovery","attack.t1482","attack.t1087","attack.t1087.001","attack.t1087.002","attack.t1069.001","attack.t1069.002","attack.t1069","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_malicious_commandlets.yml","techniques":["T1482","T1087","T1087.001","T1087.002","T1069.001","T1069.002","T1069","T1059.001"],"cves":[]},{"id":"89819aa4-bbd6-46bc-88ec-c7f7fe30efa6","title":"Malicious PowerShell Commandlets - ScriptBlock","author":"Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer","status":"test","level":"high","date":"2017-03-05","modified":"2025-12-10","description":"Detects Commandlet names from well-known PowerShell exploitation frameworks","references":["https://adsecurity.org/?p=2921","https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries","https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1","https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1","https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1","https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1","https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/","https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/","https://github.com/calebstewart/CVE-2021-1675","https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1","https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html","https://github.com/HarmJ0y/DAMP","https://github.com/samratashok/nishang","https://github.com/DarkCoderSc/PowerRunAsSystem/","https://github.com/besimorhino/powercat","https://github.com/Kevin-Robertson/Powermad","https://github.com/adrecon/ADRecon","https://github.com/adrecon/AzureADRecon","https://github.com/The-Viper-One/Invoke-PowerDPAPI/","https://github.com/Arno0x/DNSExfiltrator/"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.discovery","attack.t1482","attack.t1087","attack.t1087.001","attack.t1087.002","attack.t1069.001","attack.t1069.002","attack.t1069","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml","techniques":["T1482","T1087","T1087.001","T1087.002","T1069.001","T1069.002","T1069","T1059.001"],"cves":[]},{"id":"8c3a6607-b7dc-4f0d-a646-ef38c00b76ee","title":"Active Directory Group Enumeration With Get-AdGroup","author":"frack113","status":"test","level":"low","date":"2022-03-17","modified":"2022-11-17","description":"Detects usage of the \"Get-AdGroup\" cmdlet to enumerate Groups within Active Directory","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.t1069.002"],"path":"rules/windows/powershell/powershell_script/posh_ps_get_adgroup.yml","techniques":["T1069.002"],"cves":[]},{"id":"9212f354-7775-4e28-9c9f-8f0a4544e664","title":"Active Directory Database Snapshot Via ADExplorer","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-03-14","modified":"2025-07-09","description":"Detects the execution of Sysinternals ADExplorer with the \"-snapshot\" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.","references":["https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html","https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer","https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24","https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/","https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/","https://trustedsec.com/blog/adexplorer-on-engagements"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1087.002","attack.t1069.002","attack.t1482"],"path":"rules/windows/process_creation/proc_creation_win_sysinternals_adexplorer_execution.yml","techniques":["T1087.002","T1069.002","T1482"],"cves":[]},{"id":"968eef52-9cff-4454-8992-1e74b9cbad6c","title":"Reconnaissance Activity","author":"Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community","status":"test","level":"high","date":"2017-03-07","modified":"2022-08-22","description":"Detects activity as \"net user administrator /domain\" and \"net group domain admins /domain\"","references":["https://findingbad.blogspot.de/2017/01/hunting-what-does-it-look-like.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.discovery","attack.t1087.002","attack.t1069.002","attack.s0039"],"path":"rules/windows/builtin/security/win_security_susp_net_recon_activity.yml","techniques":["T1087.002","T1069.002"],"cves":[]},{"id":"9a132afa-654e-11eb-ae93-0242ac130002","title":"PUA - AdFind Suspicious Execution","author":"Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community","status":"test","level":"high","date":"2021-02-02","modified":"2025-10-24","description":"Detects AdFind execution with common flags seen used during attacks","references":["https://www.joeware.net/freetools/tools/adfind/","https://thedfirreport.com/2020/05/08/adfind-recon/","https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/","https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/","https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx","https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md","https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1087.002/T1087.002.md#atomic-test-7---adfind---enumerate-active-directory-user-objects"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1018","attack.t1087.002","attack.t1482","attack.t1069.002","stp.1u"],"path":"rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage.yml","techniques":["T1018","T1087.002","T1482","T1069.002"],"cves":[]},{"id":"b2317cfa-4a47-4ead-b3ff-297438c0bc2d","title":"HackTool - SharpView Execution","author":"frack113","status":"test","level":"high","date":"2021-12-10","modified":"2023-02-14","description":"Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems","references":["https://github.com/tevora-threat/SharpView/","https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-4---system-discovery-using-sharpview"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1049","attack.t1069.002","attack.t1482","attack.t1135","attack.t1033"],"path":"rules/windows/process_creation/proc_creation_win_hktl_sharpview.yml","techniques":["T1049","T1069.002","T1482","T1135","T1033"],"cves":[]},{"id":"df55196f-f105-44d3-a675-e9dfb6cc2f2b","title":"Renamed AdFind Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-08-21","modified":"2025-02-26","description":"Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.","references":["https://www.joeware.net/freetools/tools/adfind/","https://thedfirreport.com/2020/05/08/adfind-recon/","https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/","https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/","https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx","https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1018","attack.t1087.002","attack.t1482","attack.t1069.002"],"path":"rules/windows/process_creation/proc_creation_win_renamed_adfind.yml","techniques":["T1018","T1087.002","T1482","T1069.002"],"cves":[]},{"id":"ef61af62-bc74-4f58-b49b-626448227652","title":"Suspicious Active Directory Database Snapshot Via ADExplorer","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-03-14","modified":"2025-07-09","description":"Detects the execution of Sysinternals ADExplorer with the \"-snapshot\" flag in order to save a local copy of the active directory database to a suspicious directory. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.","references":["https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html","https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer","https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24","https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/","https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/","https://trustedsec.com/blog/adexplorer-on-engagements"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1087.002","attack.t1069.002","attack.t1482"],"path":"rules/windows/process_creation/proc_creation_win_sysinternals_adexplorer_susp_execution.yml","techniques":["T1087.002","T1069.002","T1482"],"cves":[]},{"id":"f376c8a7-a2d0-4ddc-aa0c-16c17236d962","title":"HackTool - Bloodhound/Sharphound Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-12-20","modified":"2023-02-04","description":"Detects command line parameters used by Bloodhound and Sharphound hack tools","references":["https://github.com/BloodHoundAD/BloodHound","https://github.com/BloodHoundAD/SharpHound"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1087.001","attack.t1087.002","attack.t1482","attack.t1069.001","attack.t1069.002","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_bloodhound_sharphound.yml","techniques":["T1087.001","T1087.002","T1482","T1069.001","T1069.002","T1059.001"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}