Attackers use AdFind to query Active Directory for users, groups, computers, trusts and other directory objects during reconnaissance. It helps them map privileges, locate targets and plan lateral movement. Defenders should monitor for unusual directory enumeration from non-administrative hosts, especially where the tool is launched outside standard admin workflows.
Why AdFind shows up in attacker reconnaissance
AdFind is useful to attackers because it turns Active Directory into a search space they can query quickly. Once they can enumerate users, groups, computers and trust relationships, they can identify high-value accounts, map administrative structure and understand where privileges are concentrated. That makes it easier to choose a lateral movement path with fewer blind spots.
The important detail is that AdFind is not usually the end goal. It is part of the discovery phase that supports later actions such as credential access, target selection and privilege escalation. In practice, the tool is attractive when an environment has weak monitoring, permissive admin tooling habits or little separation between routine administration and suspicious directory querying.
What attackers learn from directory enumeration
Directory enumeration gives an attacker context, not just names. By inspecting group membership, nested groups, computer objects, trusts and related metadata, they can infer where privileged access exists, which hosts may be worth targeting and which relationships connect otherwise separate parts of the environment. That intelligence reduces the cost of follow-on attacks.
AdFind is especially useful when the attacker already has some foothold but not full visibility. It helps answer practical questions: which accounts look privileged, which systems are likely to hold useful sessions, where are trust boundaries, and what parts of the directory deserve deeper probing. That is why directory queries often appear early in an intrusion chain rather than after the attacker has already moved widely.
For defenders, the distinction between normal administration and adversary recon is often in the pattern. A single query is not the story. Repeated enumeration from an endpoint that does not normally administer Active Directory, or from a host that should not be issuing broad LDAP-style queries, is much more meaningful than any isolated command.
How to spot and contain AdFind activity
Detection should focus on where the tool runs, what it queries and whether that behavior fits the user or host role. Unusual use from non-administrative workstations, service accounts that do not normally perform directory discovery, and bursts of broad object enumeration are all signals worth triaging. Logging becomes more valuable when it can show command-line context and the source host, not just the directory object that was queried.
Containment is usually straightforward if the activity is caught early: isolate the source host, review recent authentications and privileged group changes, and look for nearby use of remote execution or credential harvesting tools. AdFind itself is not the compromise, but it is often a strong indicator that the attacker is building a map for the next stage.
Risk and Threat Considerations
AdFind is risky because it shortens the reconnaissance phase and helps an intruder turn partial access into a usable map of the directory. That can expose privilege structure, trust paths and targetable systems before defenders realise the environment is being profiled.
Failure mechanism: An attacker with a foothold runs broad directory queries from a host that should not be administering Active Directory, then uses the results to identify privileged accounts, sensitive groups and likely lateral movement paths.
Impact: Faster target selection, better privilege mapping and earlier preparation for credential theft or lateral movement, often before any obvious service disruption appears.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1069 — Permission Groups Discovery | AdFind is used to enumerate groups and directory relationships for recon and movement. |
| T1087 — Account Discovery | The tool is used to enumerate users and other directory objects before lateral movement. | |
| Recommendation — Map AdFind activity to discovery techniques and hunt for privilege-mapping queries from unusual hosts. Alert on broad account-enumeration patterns from non-admin systems and investigate the source host. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Detection depends on logging command-line and directory-query activity to distinguish admin use from recon. |
| Recommendation — Centralize and review directory-access logs to detect unusual enumeration behavior. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Analysts need reviewable logs to spot suspicious directory enumeration and correlate it with host context. |
| AC-6 — Least Privilege | Restricting admin paths reduces where attackers can run recon tools and what they can learn from them. | |
| Recommendation — Correlate directory-query events with source-host and account context to flag suspicious recon. Limit administrative directory access to approved hosts and accounts with the minimum necessary privilege. | ||
Practitioner Guidance
What to verify: Confirm whether the source host is expected to perform directory administration. If not, treat repeated queries for users, groups, computers or trusts as suspicious even when no immediate changes are made.
What good looks like: Directory enumeration from a small, known set of admin systems, with command-line logging and alerting that can distinguish normal admin workflows from broad recon. The Living off the Land Guide is useful here because it places AdFind in the wider context of dual-use tooling that defenders need to baseline and monitor.
Decision rule: If AdFind appears on a non-admin host, prioritize source-host containment and recent authentication review before deciding whether the activity was exploratory or part of a larger intrusion. The State of NHI & AI Agent Breach Report 2026 is a useful companion when you are thinking about how reconnaissance, credential theft and lateral movement usually fit together in real incidents.
Practitioner takeaway: The main question is not whether AdFind can enumerate Active Directory, it is whether your environment can tell the difference between a legitimate admin query pattern and an attacker quietly building an access map.