Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

INC Ransom – AdFind/Advanced IP Scanner Active Directory Recon

Incransom Discovery Sentinel
MITRE ATT&CK
Domain Trust Discovery
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live group_tools dataset (incransom)
What This Detects
Ahead of its Restic/s5cmd exfiltration stage, INC Ransom runs AdFind alongside Advanced IP Scanner and SoftPerfect NetScan for AD and network discovery — two or more of these tools on one host in a short window is a strong pre-exfil signal.
Query
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ ("adfind.exe","advanced_ip_scanner.exe","netscan.exe")
| summarize ToolsSeen = make_set(FileName), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, AccountName
| where array_length(ToolsSeen) >= 2

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.