Adexplorer - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/adexplorer/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 14:00:00 +0000Active Directory Discovery using AdExplorerhttps://feed.craftedsignal.io/briefs/2024-01-ad-explorer-discovery/Wed, 03 Jan 2024 14:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-ad-explorer-discovery/AdExplorer, a legitimate Active Directory viewer, can be abused by adversaries for domain reconnaissance, and this rule detects its execution to identify potential malicious discovery activities.AdExplorer is a legitimate utility used for viewing and editing Active Directory (AD) environments. It provides advanced features for exploring AD databases and even creating snapshots for offline analysis. While useful for administrators, adversaries can leverage AdExplorer for reconnaissance purposes within a compromised domain. This involves gathering information about users, groups, trusts, and network configurations to aid in lateral movement or privilege escalation. This activity is often an early stage of post-compromise activity, where attackers are mapping out the AD environment to identify valuable targets and attack paths. Detecting the use of AdExplorer, especially in unusual contexts, can provide an early warning sign of malicious activity within the network. The rule specifically looks for processes named "ADExplorer*.exe" or having the original file name "AdExp."

Attack Chain

  1. An attacker gains initial access to a system within the target network.
  2. The attacker downloads or copies the AdExplorer utility (ADExplorer.exe) to the compromised host.
  3. The attacker executes AdExplorer.exe.
  4. AdExplorer enumerates domain accounts (T1087.002) and groups (T1069.002) within the Active Directory environment.
  5. AdExplorer queries the Active Directory to discover domain trusts (T1482).
  6. The attacker saves a snapshot of the AD database for offline viewing and analysis.
  7. The attacker analyzes the collected information to identify high-value targets, privileged accounts, and potential lateral movement paths.
  8. The attacker uses the gathered information to further compromise the network or achieve their final objective.

Impact

Successful exploitation and reconnaissance via AdExplorer allows attackers to map out the Active Directory environment. This allows them to identify critical assets, privileged accounts, and potential vulnerabilities. This information is leveraged for lateral movement, privilege escalation, and ultimately, the exfiltration of sensitive data, deployment of ransomware, or other malicious activities. While the tool itself is benign, its usage in a compromised environment can indicate malicious intent, and is a sign of increased attack risk.

Recommendation

  • Deploy the Sigma rule "Active Directory Discovery using AdExplorer - Process Name" to your SIEM to detect AdExplorer execution based on process name.
  • Deploy the Sigma rule "Active Directory Discovery using AdExplorer - Original File Name" to your SIEM to detect AdExplorer execution based on original file name.
  • Investigate any alerts generated by these rules, focusing on the context of the execution (user, machine, and associated network activity).
  • Monitor process creation events for the execution of AdExplorer with unusual command-line arguments or from unexpected locations to identify potentially malicious use.
]]>lowadvisorydiscoveryactive-directoryadexplorerwindows