Skip to content
skopnix
Detections · Rule
← Sigma detectionsSigma · Behaviour (ATT&CK technique)

AdFind domain trust or controller enumeration (T1482)

SIGmediumconfidence 70/100generated 2026-10-18

AdFind.exe run with trustdmp / dclist / domainlist — the reconnaissance step that precedes lateral movement in many ransomware intrusions. Observed for: APT35, blackbyte, Chimera, Earth Lusca, FIN8, LOTUS PANDA and 4 more.

ATT&CK
T1482 mitre ↗
Linked actors
APT35 · blackbyte · Chimera · Earth Lusca · FIN8 · LOTUS PANDA · MirrorFace · Storm-0501 · Storm-1567 · UNC4393
False positives
Requires adfind plus a trust / DC enumeration switch; generic LDAP queries with other tools do not match.

Sigma rule

skopnix-sigma-ttp-t1482-3717fd61.ymldownload .yml ↓
title: Skopnix - AdFind domain trust or controller enumeration (T1482)
id: a68d5a5b-ad68-58d9-a72a-518f87b379e7
status: experimental
description: 'AdFind.exe run with trustdmp / dclist / domainlist — the reconnaissance step that precedes lateral movement in many ransomware intrusions. Observed for: APT35, blackbyte, Chimera, Earth Lusca, FIN8, LOTUS PANDA and 4 more.'
references:
  - https://attack.mitre.org/techniques/T1482/
  - https://skopnix.com/actors/apt35
  - https://skopnix.com/actors/blackbyte
  - https://skopnix.com/actors/chimera
  - https://skopnix.com/actors/earth-lusca
  - https://skopnix.com/actors/fin8
  - https://skopnix.com/actors/lotus-panda
  - https://skopnix.com/actors/mirrorface
  - https://skopnix.com/actors/storm-0501
  - https://skopnix.com/actors/storm-1567
  - https://skopnix.com/actors/unc4393
author: skopnix
date: '2026-10-18'
tags:
  - attack.discovery
  - attack.t1482
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \adfind.exe
  selection_cli:
    CommandLine|contains:
      - trustdmp
      - dclist
      - domainlist
  condition: all of selection_*
falsepositives:
  - Directory administrators who use AdFind for audits (whitelist the admin accounts)
level: medium

How to deploy on Sigma

  1. 1.Convert for your SIEM with sigma-cli / pySigma, e.g. sigma convert -t splunk -p sysmon rule.yml.
  2. 2.Run it as a hunt first: every rule ships as status experimental.
  3. 3.Promote to an alert once a week of results is clean on your data.

Check · The processing pipeline must map the logsource (firewall, dns, proxy, webserver, process_creation) to your field names.

References