AdFind is a free command-line query tool that can be used for gathering information from Active Directory.[1][2][3]

ID: S0552
Type: TOOL
Platforms: Windows
Version: 1.2
Created: 28 December 2020
Last Modified: 02 March 2023

Techniques Used

Domain ID Name Use
Enterprise T1087 .002 Account Discovery: Domain Account

AdFind can enumerate domain users.[1][2][3][4][5]

Enterprise T1482 Domain Trust Discovery

AdFind can gather information about organizational units (OUs) and domain trusts from Active Directory.[1][2][3][5]

Enterprise T1069 .002 Permission Groups Discovery: Domain Groups

AdFind can enumerate domain groups.[1][2][3][5]

Enterprise T1018 Remote System Discovery

AdFind has the ability to query Active Directory for computers.[1][2][3][4]

Enterprise T1016 System Network Configuration Discovery

AdFind can extract subnet information from Active Directory.[1][2][3]

Groups That Use This Software

ID Name References
G0037 FIN6


G0046 FIN7


G0016 APT29


G0102 Wizard Spider


G0092 TA505


G0045 menuPass



ID Name Description
C0015 C0015


C0024 SolarWinds Compromise