| elastic |
AdFind Command Activity |
production |
2026-10-06 |
| splunk |
GetWmiObject Ds Computer with PowerShell |
production |
2026-10-02 |
| splunk |
GetDomainController with PowerShell |
production |
2026-10-02 |
| splunk |
GetAdComputer with PowerShell Script Block |
production |
2026-10-02 |
| splunk |
Remote System Discovery with Adsisearcher |
production |
2026-10-02 |
| splunk |
Windows AdFind Exe |
production |
2026-10-02 |
| elastic |
Enumeration Command Spawned via WMIPrvSE |
production |
2026-09-18 |
| elastic |
Enumerating Domain Trusts via DSQUERY.EXE |
production |
2026-09-18 |
| elastic |
Active Directory Discovery using AdExplorer |
production |
2026-09-18 |
| elastic |
Potential Enumeration via Active Directory Web Service |
production |
2026-09-18 |
| elastic |
Potential Network Sweep Detected |
production |
2026-09-18 |
| elastic |
ICMP Timestamp or Information Request from the Internet |
production |
2026-09-18 |
| elastic |
Potential Network Scan Executed From Host |
production |
2026-09-18 |
| elastic |
Spike in Firewall Denies |
production |
2026-09-18 |
| elastic |
DNS Enumeration Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Subnet Scanning Activity from Compromised Host |
production |
2026-09-18 |
| elastic |
Enumerating Domain Trusts via NLTEST.EXE |
production |
2026-09-18 |
| elastic |
Newly Seen Commonly Abused Network Scanner |
production |
2026-09-15 |
| splunk |
Domain Controller Discovery with Nltest |
production |
2026-07-20 |
| sigma |
Webshell Detection With Command Line Keywords |
test |
2026-07-14 |
| splunk |
Cisco IOS XE Remote Access Probe Burst |
production |
2026-05-20 |
| splunk |
Cisco Secure Firewall - Blocked Connection |
production |
2026-05-13 |
| splunk |
Domain Controller Discovery with Wmic |
production |
2026-05-13 |
| splunk |
GetAdComputer with PowerShell |
production |
2026-05-13 |
| splunk |
GetDomainComputer with PowerShell |
production |
2026-05-13 |
| splunk |
GetDomainComputer with PowerShell Script Block |
production |
2026-05-13 |
| splunk |
GetDomainController with PowerShell Script Block |
production |
2026-05-13 |
| splunk |
GetWmiObject Ds Computer with PowerShell Script Block |
production |
2026-05-13 |
| splunk |
Remote System Discovery with Dsquery |
production |
2026-05-13 |
| splunk |
Remote System Discovery with Wmic |
production |
2026-05-13 |
| splunk |
Windows Get-AdComputer Unconstrained Delegation Discovery |
production |
2026-05-13 |
| splunk |
Windows Netspy Network Scanner Execution |
production |
2026-05-13 |
| splunk |
Windows PowerView Constrained Delegation Discovery |
production |
2026-05-13 |
| splunk |
Windows PowerView Unconstrained Delegation Discovery |
production |
2026-05-13 |
| splunk |
Windows PsTools Recon Usage |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Repeated Blocked Connections |
production |
2026-05-13 |
| sigma |
HackTool - NetExec Execution |
experimental |
2026-03-29 |
| sigma |
PUA - AdFind Suspicious Execution |
test |
2025-10-24 |
| snort |
ET TROJAN APT28 Russia Macro Loader HTTP POST |
rev 1 |
2025-05-22 |
| suricata |
ET MALWARE APT28 Russia Macro Loader HTTP POST |
rev 1 |
2025-05-22 |
| sigma |
Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock |
experimental |
2025-03-05 |
| sigma |
Renamed AdFind Execution |
test |
2025-02-26 |
| sigma |
Webshell Hacking Activity Patterns |
test |
2023-11-09 |
| sigma |
Active Directory Computers Enumeration With Get-AdComputer |
test |
2023-07-08 |
| sigma |
PUA - Adidnsdump Execution |
test |
2023-02-21 |
| sigma |
Share And Session Enumeration Using Net.EXE |
stable |
2023-02-21 |
| sigma |
Nltest.EXE Execution |
test |
2023-02-03 |
| sigma |
Cisco Discovery |
test |
2023-01-04 |
| sigma |
Chopper Webshell Process Pattern |
test |
2022-10-01 |
| sigma |
Net.EXE Execution |
test |
2022-07-11 |
| sigma |
Suspicious Scan Loop Network |
test |
2022-03-12 |
| sigma |
DirectorySearcher Powershell Exploitation |
test |
2022-02-12 |
| sigma |
Macos Remote System Discovery |
test |
2021-11-27 |
| sigma |
Linux Remote System Discovery |
test |
2021-11-27 |
| sentinel |
Probable AdFind Recon Tool Usage (Normalized Process Events) |
Scheduled |
— |