Netskope Threat Labs

ADRecon

ATP Sandbox Adv. HeuristicsAV

ADRecon is a hack tool that extracts and reports configuration information from Active Directory environments, which cyberattackers can use for reconnaissance.

First seen
December 2023
Last seen
October 2026
Alert Name
Dump:Generic.ADRecon.A.FFFFFFFE
Dump:Generic.ADRecon.A.FFFFFFFE:DB8C0
Dump:Generic.ADRecon.A.FFFFFFFE:F8DA2
Generic.ADRecon.A.064F9996
Generic.ADRecon.A.0C815A5F
Generic.ADRecon.A.12F97383
Generic.ADRecon.A.15F51133
Generic.ADRecon.A.190EA10A
Generic.ADRecon.A.2475FAC0
Generic.ADRecon.A.280A0DD9