cscli scenarios install sigmahq/proc_creation_win_renamed_adfind1type: trigger2name: sigmahq/proc_creation_win_renamed_adfind3description: |4 Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.CommandLine contains 'domainlist' || evt.Parsed.CommandLine contains 'trustdmp' || evt.Parsed.CommandLine contains 'dcmodes' || evt.Parsed.CommandLine contains 'adinfo' || evt.Parsed.CommandLine contains ' dclist ' || evt.Parsed.CommandLine contains 'computer_pwdnotreqd' || evt.Parsed.CommandLine contains 'objectcategory=' || evt.Parsed.CommandLine contains '-subnets -f' || evt.Parsed.CommandLine contains 'name="Domain Admins"' || evt.Parsed.CommandLine contains '-sc u:' || evt.Parsed.CommandLine contains 'domainncs' || evt.Parsed.CommandLine contains 'dompol' || evt.Parsed.CommandLine contains ' oudmp ' || evt.Parsed.CommandLine contains 'subnetdmp' || evt.Parsed.CommandLine contains 'gpodmp' || evt.Parsed.CommandLine contains 'fspdmp' || evt.Parsed.CommandLine contains 'users_noexpire' || evt.Parsed.CommandLine contains 'computers_active' || evt.Parsed.CommandLine contains 'computers_pwdnotreqd' || evt.Parsed.Imphash in ['bca5675746d13a1f246e2da3c2217492', '53e117a96057eaf19c41380d0e87f1c2'] || evt.Parsed.Hashes contains 'IMPHASH=BCA5675746D13A1F246E2DA3C2217492' || evt.Parsed.Hashes contains 'IMPHASH=53E117A96057EAF19C41380D0E87F1C2' || evt.Parsed.OriginalFileName == 'AdFind.exe') && not (evt.Parsed.Image endsWith '\\AdFind.exe'))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t101815 - attack.t1087.00216 - attack.t148217 - attack.t1069.0021819 label: "Renamed AdFind Execution"20 behavior : "windows:audit"21 remediation: false2223scope:24 type: ParentProcessId25 expression: evt.Parsed.ParentProcessId2627