Renamed AdFind Execution for Active Directory Reconnaissance
Detects the execution of AdFind.exe, a legitimate command-line tool often used by adversaries for Active Directory reconnaissance. The rule specifically looks for renamed AdFind executables by checking for specific command-line arguments and known ImpHashes, while excluding executions of the original 'AdFind.exe' name.
Sigma
