BIOC
Informational
✕
ADFind queries Active Directory for Exchange groups
A process executed with ADFind parameters and used to extract data on built-in groups for the Exchange server (e.g. "Organization Management").
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Discovery
- Status:
- Enabled
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Permission Groups Discovery: Domain Groups (T1069.002)
Indicator:
Process action type = execution AND target process cmd =~ .*default.*Organization Management.*objectcategory=\*.* AND target process name != adfind.exe
Preventable: yes