ADFind
AdFind is a legitimate command-line Active Directory query utility from joeware.net that is frequently abused as a dual-use reconnaissance tool during post-compromise activity. The content consistently describes it being used to query and extract data from Active Directory, including enumerating computers, domain users, domain groups, organizational units, domain trusts, remote systems, and system network configuration. It is mapped to ATT&CK-style discovery behaviors including Domain Account Discovery, Domain Trust Discovery, Permission Groups Discovery: Domain Groups, Remote System Discovery, and System Network Configuration Discovery.
The tool appears repeatedly in intrusion reporting as renamed or obfuscated variants to evade detection. In SolarWinds-related intrusions investigated by Volexity, a file named sqlceip.exe was identified as AdFind masquerading as the Microsoft SQL Server Telemetry Client. Microsoft also noted renamed AdFind used by the SolarWinds actor for Active Directory reconnaissance against domain controllers. SentinelLABS reported Black Basta using a uniquely obfuscated AdFind variant named AF.exe for Active Directory discovery.
Threat actors and operations explicitly associated in the content with AdFind use include APT29/NOBELIUM during the SolarWinds compromise, Dark Halo/UNC2452-related activity, UNC2447, Black Basta, Akira affiliates, Mustang Panda, Lotus Blossom, Play, Wizard Spider, and Andariel, as well as broader ransomware and intrusion activity where attackers used AdFind alongside tools such as BloodHound, Mimikatz, Cobalt Strike, ProcDump, PsExec, and WinPEAS. Reported use cases center on reconnaissance and environment mapping prior to credential theft, privilege escalation, lateral movement, email theft, exfiltration, or ransomware deployment.
Targeting reflected in the content is primarily Windows enterprise environments with Active Directory, including incidents affecting a US-based think tank in the SolarWinds campaign and health-sector organizations in reporting on Akira activity. No malware-style persistence or self-propagation behavior is attributed to AdFind itself in the provided content; it is described as a legitimate utility abused by attackers. A notable indicator from the content is the use of renamed binaries such as sqlceip.exe and AF.exe to disguise AdFind execution.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
10 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The attacker also made use of a file called sqlceip.exe, which upon first glance might appear as the legitimate version of SQL Server Telemetry Client provided by Microsoft. However, Volexity determined this tool was actually a version of AdFind from joeware.net. AdFind is a command-line tool used for querying and extracting data from Active Directory.
The attacker also made use of a file called sqlceip.exe, which upon first glance might appear as the legitimate version of SQL Server Telemetry Client provided by Microsoft. However, Volexity determined this tool was actually a version of AdFind from joeware.net. AdFind is a command-line tool used for querying and extracting data from Active Directory.
AdFind has the ability to query Active Directory for computers.
...open-source and dual-use tools as used and/or customized by the actors: ... AdFind ...
This includes running native Windows commands on compromised servers, executing ADFind on the Active Directory...
By abusing legitimate tools such as Cobalt Strike, Mimikatz, ProcDump, AdFind, and WinPEAS, the group conducts credential theft, privilege escalation, lateral movement, and data exfiltration.
...UNC2447 has been observed using the following tools: ADFIND, BLOODHOUND, MIMIKATZ...
Techniques & procedures
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 techniqueThe content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.
Stealth
1 techniqueFiles pertaining to the threat actor’s post exploitation activities such as reconnaissance of the internal network, were deleted to hinder forensic analysis efforts.
Discovery
10 techniquesThe content repeatedly describes actors and malware using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, netsh interface show, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, and network adapter/interface details.
Several actors used discovery tools such as BloodHound, AdFind, Advanced IP Scanner, SoftPerfect Network Scanner, NBTscan, RustScan, and SNScan for user, system, and network discovery.
Below is a basic example of how to use adfind.exe to pull user data... After obtaining a full list of users on the domain check for common weak passwords.
Commands such as net user /domain and net group /domain ... can list domain users and groups.
GeminiDuke focuses primarily on gathering details about the victim’s computer’s configuration.
ATT&CK Mapping The full TTP set observed in this intrusion mapped to the following ATT&CK techniques: Discovery T1087, T1482 Account / Domain Trust Discovery EID 4688 (nltest.exe, net.exe)
T1087.002 - Domain Account Description from ATT&CK. Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior.
Domain Trust Discovery [T1482]: Can involve the use of custom scripts or tools like AdFind to gather information on domain trust relationships and identify ways for a threat actor to move lateral movement
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Active Directory reconnaissance tool used to enumerate and query AD objects; leveraged post-compromise to map environments and identify targets for lateral movement.
Active Directory enumeration tool abused by Play/Balloonfly for discovery in victim environments prior to ransomware deployment.
Active Directory query utility used for reconnaissance/AD enumeration; in these intrusions it is used in an obfuscated form to inventory domain computers and related attributes.
Active Directory discovery tool used to enumerate directory objects/trusts to support targeting and lateral movement.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.