Usage of Csvde for Active Directory Enumeration

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the use of CSVDE utitlity for Active Directory objects discovery purposes. Csvde is a command-line tool that is built into Windows Server 2008 in the %windir%/system32 folder. It is available if you have the AD DS or Active Directory Lightweight Directory Services (AD LDS) server role installed. Threat actors may use CSVDE to extract information from Active Directory, such as user accounts, groups, and organizational units.

2025-05-26 00:00:00

None

764f0589-18eb-4ef2-83db-9fced90c64aa

attack.discovery attack.t1087.002

Nextron Sigma feed only (private)