SuspiciousEnumerationUsingAdfind[Nobelium]

Attackers can use Adfind which is administrative tool to gather information about domain controllers or ADFS servers. They may also rename executables with other benign tools on the system. The below query will look for Adfind usage in command line arguments irrespective of executable name in short span of time. You can limit query this to your DC and ADFS servers. Below references talk about suspicious use of adfind by adversaries. 1. AdFind Recon 2. Navigating the MAZE: Tactics, Techniques and Procedures Associated With MAZE Ransomware Incidents 3. Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers This query is inspired by a Azure Sentinel detection.