Skip to content
Threat Feed
Subscribe

Actor

Wizard Spider

1 brief RSS
Also known as: Conti
medium advisory

AdFind.exe Execution with Reconnaissance Arguments

This rule detects the execution of AdFind.exe with specific command-line arguments used for reconnaissance, often associated with threat actors like Wizard Spider, FIN6, and groups linked to SUNBURST, who use it to enumerate domain controllers.

AdFind +2 Conti +3 active-directory reconnaissance discovery
2r 1t 1i