Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

LockBit 3.0 – BloodHound/AdFind/Seatbelt Active Directory Recon Chain

Lockbit3 Discovery Sentinel
MITRE ATT&CK
Domain Account
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (lockbit3)
What This Detects
Beyond its shadow-copy/Defender-kill sequence, LockBit 3.0 affiliates run a distinctive three-tool AD recon chain — Bloodhound/SharpHound, AdFind and Seatbelt — in short succession before moving laterally.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName has_any ("sharphound","bloodhound","adfind","seatbelt")
   or ProcessCommandLine has_any ("SharpHound.exe","AdFind.exe","Seatbelt.exe")
| summarize ToolsSeen = make_set(FileName), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, AccountName
| where array_length(ToolsSeen) >= 2

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.