How do you detect Active Directory enumeration with AdFind?

How AdFind Stands Out in Directory Enumeration

AdFind is useful to defenders because it rarely looks like a single noisy “attack” on its own. It is often a signed administrative utility used to query active directory quickly, so the detection problem is separating legitimate administration from repeated, automated, or opportunistic enumeration. That means the strongest signals are execution context, command shape, and the scale and timing of LDAP-style queries.

Focus first on where and how it runs. AdFind launched from a workstation, jump host, or server that normally does not perform directory discovery is more suspicious than the same binary on an admin tooling host. Short bursts that list users, groups, trusts, privileged objects, or domain details are especially important because they show intent to map the directory rather than complete a normal admin task.

Command-line inspection matters because operators often pass targets, filters, and output options that reveal what they are trying to learn. Repeated runs with similar query patterns, especially when they are aimed at privileged groups, domain controllers, or broad object classes, are a strong indicator that the activity is being used for discovery rather than a one-off administrative lookup.

Telemetry That Reveals Enumeration Before It Blends In

Use endpoint telemetry and directory telemetry together, because either source alone can be ambiguous. Process creation logs show the binary, parent process, user context, and command line. Directory access logs show the resulting query volume and whether a host is repeatedly asking for the same kinds of objects. When both line up, you can see whether the host is acting like an administrator or like a recon tool.

The best pattern to hunt is a concentrated, short-lived spike in directory lookups from a host or account that does not normally generate that volume. A burst that touches many users, groups, trusts, or privileged containers in a short time window is more meaningful than a single query. If the same host also touches multiple domain controllers, the case for enumeration becomes stronger.

Correlate the query burst with identity context. Service accounts, non-administrative users, and endpoints outside the usual admin plane deserve extra scrutiny because adversaries often borrow a valid account and then use legitimate tooling to explore the directory. That is where Living off the Land Guide helps place AdFind alongside other dual-use utilities that defenders should watch for in command-line telemetry.

What Good Detection Looks Like in Practice

Effective detection is not just “AdFind ran.” It is a combination of process lineage, host role, account role, and query behavior. A benign admin session usually has a reason, a known workstation, and a limited scope. Suspicious enumeration tends to show broader search intent, repetition, and a mismatch between the host’s normal function and the objects being queried.

Build detections around repeated discovery against the directory rather than around a single command signature alone. If you only alert on the tool name, attackers can rename or stage it differently. If you alert on the behavioral pattern, broad enumeration becomes visible even when the binary is wrapped, copied, or launched through another process. For that reason, the AdFind pattern belongs in a wider hunt strategy for Top 10 Active Directory Security Risks, especially where privileged discovery and control-plane visibility are weak.

When you need a broader control perspective, the point is to limit who can enumerate sensitive directory data and to detect when that boundary is crossed. Directory hardening, tiered administration, and strict administrative workstations reduce the number of places where this activity should ever appear. The Active Directory and Entra ID Hardening Guide is the most directly useful internal reference for those containment decisions.

Risk and Threat Considerations

AdFind-style enumeration is risky because it gives an attacker a fast map of the directory, including users, groups, trusts, and privilege-bearing objects. Once that map is built, follow-on actions such as privilege escalation, lateral movement, and targeted phishing become much easier. Even when the activity is read-only, it can materially reduce an attacker’s uncertainty and shorten the path to higher-value access.

Failure mechanism: Legitimate directory query tooling is used from a host or account that is allowed to read directory data, so the activity can look like normal administration while actually collecting reconnaissance at scale.

Impact: Security teams may miss early-stage discovery, allowing attackers to identify privileged relationships, choose better targets, and move toward domain-level compromise with less friction.

Practitioner Guidance

What to verify: Confirm whether the host, account, and command pattern match an approved administrative workflow. A single query from a known admin jump box is very different from repeated, broad enumeration from an ordinary workstation or service account.

What to prioritise: Correlate process creation with directory query volume before you tune the alert. A good detection should tell you who ran it, from where, what they queried, and whether the pattern is broad or targeted.

Practitioner takeaway: The most useful AdFind detection is behavioral, not signature-only, because the same tool can be either normal admin work or early-stage reconnaissance depending on host role, account role, and query burst pattern.

Related resources from NHI Mgmt Group

• Guide: Identity Attack Paths Guide
• How do you detect Active Directory enumeration using PowerShell cmdlets?
• How do you detect a new domain trust being created in Active Directory?
• How should security teams detect password spraying in Active Directory?
• How should security teams detect Active Directory compromise before data is exposed?