How can security teams detect AdFind?

What AdFind activity looks like in telemetry

AdFind detection starts with treating it as a directory reconnaissance tool, not just another command-line utility. The strongest signal is a host that launches AdFind to enumerate Active Directory objects at unusual times or from a workstation that does not normally perform admin discovery. That pattern matters because legitimate administration usually has a predictable source, operator, and purpose.

Watch for command lines that enumerate users, groups, computers, trusts, or domain controllers, especially when the process tree begins with scripting interpreters, remote execution tooling, or other utilities that are commonly used for hands-on-keyboard operations. Directory discovery at scale often produces repetitive LDAP reads in quick succession, which makes bursty query behaviour a useful detector when it is tied to a suspicious parent process or account.

Command-line visibility is especially valuable when paired with process creation telemetry and directory service logs. A single query may be noisy, but repeated enumeration from a non-administrative host, or from a session that has no clear operational reason to query the domain, is often the point where reconnaissance becomes operationally interesting.

How to separate benign admin use from suspicious enumeration

Context is the deciding factor. Security teams should baseline which hosts, users, and tools normally perform directory discovery, then compare AdFind usage against that baseline rather than relying on the tool name alone. An unexpected endpoint, an unusual parent process, or a service account that rarely performs interactive discovery is more important than whether the command syntax looks familiar.

It also helps to distinguish planned administration from opportunistic discovery. Admin activity is usually narrower, slower, and aligned to a known change or investigation. Suspicious use tends to be broader, faster, and paired with attempts to map trust relationships, group membership, or high-value hosts. The goal is to spot enumeration that expands attacker knowledge of the environment, not merely any query against LDAP.

For broader detection strategy, map the behaviour to known adversary discovery patterns and validate whether your logs can show the full sequence, from process launch through directory reads to any follow-on lateral movement or credential access. The MITRE ATT&CK Enterprise Matrix is a useful reference for organising those observations into a huntable analytic.

Building detections that hold up in practice

Effective AdFind detection usually combines several weak signals into one stronger alert: a suspicious process lineage, uncommon directory queries, and a host or account that is not expected to perform discovery. If you only alert on the binary name, you will miss renamed copies and wrapper scripts. If you only alert on LDAP activity, you will drown in normal directory traffic.

A better approach is to alert on the behaviour set: command-line invocation from non-admin endpoints, parent processes associated with scripts or remote execution, and rapid bursts of directory reads against objects such as users, groups, computers, and trusts. When those behaviours occur together, the likelihood of reconnaissance is much higher than with any single indicator on its own.

That is also why host telemetry and directory telemetry should be reviewed together. Process creation events show who launched the tool and how, while directory logs or network sensors can show the scope and intensity of the enumeration. If your environment already uses a broader Living off the Land Guide for dual-use tools, AdFind fits naturally into the same detection and hardening workflow.

Risk and Threat Considerations

AdFind is risky because it is a fast way to turn one foothold into a clearer picture of the domain. Once an attacker can enumerate users, groups, computers, and trusts, they can identify high-value targets, privileged relationships, and paths that are worth pursuing next. The tool is attractive precisely because it can look like routine administration unless defenders correlate process lineage and query volume.

Failure mechanism: Detection breaks when teams rely on binary-name alerts or single-event matching instead of behavioural correlation. Renamed copies, script wrappers, or remote execution chains can still produce the same directory discovery pattern while bypassing simplistic rules.

Impact: Missed enumeration gives attackers better target selection for privilege escalation, lateral movement, and persistence planning, and it can delay detection until the activity has already informed follow-on compromise.

Practitioner Guidance

What to verify: Confirm which endpoints, service accounts, and administrative workflows are legitimately allowed to perform directory discovery, then hunt for AdFind outside that profile. A detector is far more useful when it is tied to expected operator behaviour than when it only recognises the tool name.

Decision rule: If AdFind appears on a non-administrative host, or is launched by a script or remote execution tool, treat it as a hunting lead even if the command looks like standard enumeration. If it appears on an admin jump host during a documented task, validate scope and timing before escalating.

Practitioner takeaway: The most reliable AdFind detections are behavioural, not signature-only, because the real warning sign is unexpected directory reconnaissance from an account or host that should not be mapping the domain.

Related resources from NHI Mgmt Group

• Why are NHIs a critical concern for security teams?
• What steps should security teams take to prevent Shadow AI risks?
• Why is the abuse of NHIs a priority for security teams?
• What is the difference between SAST and DAST for security teams?