BIOC Informational

ADFind queries Active Directory for Exchange groups

A process executed with ADFind parameters and used to extract data on built-in groups for the Exchange server (e.g. "Organization Management").

Module:
Platform Analytics
Agent event type:
Process execution
Category:
Discovery
Status:
Enabled
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Permission Groups Discovery: Domain Groups (T1069.002)
Indicator:

Process action type = execution AND target process cmd =~ .*default.*Organization Management.*objectcategory=\*.* AND target process name != adfind.exe

Preventable: yes