From 926c05e2cd95815dc5deda9fb3f3ac4dfd52317f Mon Sep 17 00:00:00 2001
From: Swachchhanda Shrawan Poudel
 <87493836+swachchhanda000@users.noreply.github.com>
Date: Wed, 21 May 2025 02:48:13 +0545
Subject: [PATCH] Merge PR #5203 from @swachchhanda000 - Update AdFind rules

new: PUA - AdFind.EXE Execution
update: Renamed AdFind Execution - Add additional Imphash values

---------

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
---
 ...oc_creation_win_pua_adfind_enumeration.yml |  2 ++
 ...proc_creation_win_pua_adfind_execution.yml | 35 +++++++++++++++++++
 .../proc_creation_win_renamed_adfind.yml      |  8 ++++-
 3 files changed, 44 insertions(+), 1 deletion(-)
 create mode 100644 rules/windows/process_creation/proc_creation_win_pua_adfind_execution.yml

diff --git a/rules/windows/process_creation/proc_creation_win_pua_adfind_enumeration.yml b/rules/windows/process_creation/proc_creation_win_pua_adfind_enumeration.yml
index 0e99a9a83..358a69e68 100644
--- a/rules/windows/process_creation/proc_creation_win_pua_adfind_enumeration.yml
+++ b/rules/windows/process_creation/proc_creation_win_pua_adfind_enumeration.yml
@@ -3,6 +3,8 @@ id: 455b9d50-15a1-4b99-853f-8d37655a4c1b
 related:
     - id: 9a132afa-654e-11eb-ae93-0242ac130002
       type: similar
+    - id: 514e7e3e-b3b4-4a67-af60-be20f139198b
+      type: similar
 status: test
 description: Detects active directory enumeration activity using known AdFind CLI flags
 references:
diff --git a/rules/windows/process_creation/proc_creation_win_pua_adfind_execution.yml b/rules/windows/process_creation/proc_creation_win_pua_adfind_execution.yml
new file mode 100644
index 000000000..05f44f4b0
--- /dev/null
+++ b/rules/windows/process_creation/proc_creation_win_pua_adfind_execution.yml
@@ -0,0 +1,35 @@
+title: PUA - AdFind.EXE Execution
+id: 514e7e3e-b3b4-4a67-af60-be20f139198b
+related:
+    - id: 455b9d50-15a1-4b99-853f-8d37655a4c1b
+      type: similar
+status: experimental
+description: Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment
+references:
+    - https://www.joeware.net/freetools/tools/adfind/
+    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md
+author: Swachchhanda Shrawan Poudel (Nextron Systems)
+date: 2025-02-26
+tags:
+    - attack.discovery
+    - attack.t1087.002
+logsource:
+    product: windows
+    category: process_creation
+detection:
+    selection:
+        - Image|endswith: '\AdFind.exe'
+        - OriginalFileName: 'AdFind.exe'
+        - Hashes|contains:
+              - 'IMPHASH=d144de8117df2beceaba2201ad304764'
+              - 'IMPHASH=12ce1c0f3f5837ecc18a3782408fa975'
+              - 'IMPHASH=bca5675746d13a1f246e2da3c2217492'
+              - 'IMPHASH=4fbf3f084fbbb2470b80b2013134df35'
+              - 'IMPHASH=49b639b4acbecc49d72a01f357aa4930'
+              - 'IMPHASH=53e117a96057eaf19c41380d0e87f1c2'
+              - 'IMPHASH=680dad9e300346e05a85023965867201'
+              - 'IMPHASH=21aa085d54992511b9f115355e468782'
+    condition: selection
+falsepositives:
+    - Unknown
+level: medium
diff --git a/rules/windows/process_creation/proc_creation_win_renamed_adfind.yml b/rules/windows/process_creation/proc_creation_win_renamed_adfind.yml
index a0d2faf59..144003fcb 100644
--- a/rules/windows/process_creation/proc_creation_win_renamed_adfind.yml
+++ b/rules/windows/process_creation/proc_creation_win_renamed_adfind.yml
@@ -11,7 +11,7 @@ references:
     - https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md
 author: Florian Roth (Nextron Systems)
 date: 2022-08-21
-modified: 2024-11-23
+modified: 2025-02-26
 tags:
     - attack.discovery
     - attack.t1018
@@ -47,6 +47,12 @@ detection:
         Hashes|contains:
             - 'IMPHASH=BCA5675746D13A1F246E2DA3C2217492'
             - 'IMPHASH=53E117A96057EAF19C41380D0E87F1C2'
+            - 'IMPHASH=d144de8117df2beceaba2201ad304764'
+            - 'IMPHASH=12ce1c0f3f5837ecc18a3782408fa975'
+            - 'IMPHASH=4fbf3f084fbbb2470b80b2013134df35'
+            - 'IMPHASH=49b639b4acbecc49d72a01f357aa4930'
+            - 'IMPHASH=680dad9e300346e05a85023965867201'
+            - 'IMPHASH=21aa085d54992511b9f115355e468782'
     selection_3:
         OriginalFileName: 'AdFind.exe'
     filter: