AdFind

AdFind is a free command-line query tool that can be used for gathering information from Active Directory.[1][2][3]

ID: S0552
Type: TOOL
Platforms: Windows
Version: 1.0
Created: 28 December 2020
Last Modified: 29 December 2020

Techniques Used

Domain ID Name Use
Enterprise T1087 .002 Account Discovery: Domain Account

AdFind can enumerate domain users.[1][2][3]

Enterprise T1482 Domain Trust Discovery

AdFind can gather information about organizational units (OUs) and domain trusts from Active Directory.[1][2][3]

Enterprise T1069 .002 Permission Groups Discovery: Domain Groups

AdFind can enumerate domain groups.[1][2][3]

Enterprise T1018 Remote System Discovery

AdFind has the ability to query Active Directory for computers.[1][2][3]

Enterprise T1016 System Network Configuration Discovery

AdFind can extract subnet information from Active Directory.[1][2][3]

Groups That Use This Software

ID Name References
G0037 FIN6

[2]

G0045 menuPass

[4]

G0102 Wizard Spider

[3][5][6][1]

G0016 APT29

[7][8][9]

G0046 FIN7

[10]

References