CSVDE.exe LOLBIN for Active Directory Reconnaissance — FIN7 + APT10/menuPass Documented Usage, Bulk LDAP Export, Kerberoasting Precursor — Threadlinqs Intelligence
As of 2026-05-30, CSVDE.exe LOLBIN for Active Directory Reconnaissance — FIN7 + APT10/menuPass Documented Usage, Bulk LDAP Export, Kerberoasting Precursor is a high-severity apt threat attributed to FIN7 (China (APT10), Unattributed (FIN7)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-0113 · Severity: HIGH · Status: MONITORING · Category: APT
Attribution: FIN7 · China (APT10), Unattributed (FIN7) · ESPIONAGE|FINANCIAL
CSVDE.exe (csvde.exe) is a legitimate Windows Server utility for importing/exporting Active Directory data via LDAP to CSV format, weaponized as a Living-off-the-Land Binary (LOLBIN) for AD
CSVDE.exe is a command-line utility built into Windows Server (located in %windir%\system32) that imports and exports Active Directory Domain Services (AD DS) data using LDAP and CSV file format. It has been weaponized as a Living-off-the-Land Binary (LOLBIN) by sophisticated threat actors for Active Directory reconnaissance and bulk directory data exfiltration.
**V1 ASSESSMENT: The v1 title 'CSVDE.exe LDAP Directory Dumping Campaign' frames this as a specific campaign. There is NO single 'CSVDE campaign' — rather, csvde.exe is a TECHNIQUE used across multiple unrelated campaigns by different threat actors. The tool itself and its abuse are REAL and well-documented. This entry covers csvde.exe as an AD reconnaissance LOLBIN technique with documented APT usage.**
**DOCUMENTED APT USAGE (MITRE ATT&CK verified):**
1. **FIN7 (Carbanak Group)** — Financial cybercrime group. MITRE ATT&CK T1087.002 documents: 'FIN7 has also used csvde.exe, which is a built-in Windows command line tool, to export Active Directory information.' Used alongside net group, 3CF9.ps1 PowerShell scripts, and WsTaskLoad executable. FIN7 targets US automotive, retail, hospitality, and financial sectors. Source: BlackBerry April 2024 report on FIN7 targeting US automotive industry.
2. **menuPass / APT10 (Stone Panda, CVNX)** — China-nexus espionage group. MITRE ATT&CK T1087.002 documents: 'menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.' Used during Operation Cloud Hopper (2016-2017), a massive campaign targeting managed IT service providers (MSPs) to access their customers' networks. Source: PwC UK 'Operation Cloud Hopper Technical Annex' April 2017.
**CSVDE.exe CAPABILITIES (as LOLBIN):**
- **Bulk AD Export:** `csvde -f output.csv` exports ALL Active Directory objects to CSV
- **Targeted LDAP Queries:** `-r` flag allows LDAP filter (e.g., `csvde -r (objectClass=User) -f users.csv` exports all users)
- **Attribute Selection:** `-l` flag selects specific attributes (e.g., `csvde -l sAMAccountName,CN,distinguishedName -f admins.csv`)
- **Scope Control:** `-p` flag controls search scope (Base, OneLevel, SubTree)
- **Remote DC Targeting:** `-s` flag targets specific domain controllers
- **Alternative Credentials:** `-a` and `-b` flags allow authentication with different credentials
- **Binary Value Handling:** `-n` omits binary values for cleaner output
- **Port Selection:** `-t` flag allows targeting LDAP (389) or Global Catalog (3268)
**WHY CSVDE IS EFFECTIVE AS A LOLBIN:**
1. **Microsoft-signed:** Ships with Windows Server, signed by Microsoft. Not flagged by default AV/EDR.
2. **Legitimate use:** AD administrators use csvde for user provisioning, auditing, migrations. Hard to distinguish malicious from legitimate use.
3. **No download required:** Already present on Windows Server systems with AD DS/AD LDS role.
4. **Comprehensive output:** Single command exports entire directory — user accounts, groups, OUs, computers, service accounts.
5. **LDAP native:** Direct LDAP queries mean results include all queryable attributes including those not visible in GUI tools.
6. **CSV format:** Output is easily parseable for automated processing — attacker pipelines can immediately extract high-value targets (Domain Admins, service accounts with SPNs).
**ATTACK CHAIN CONTEXT:**
csvde.exe is typically used in the DISCOVERY phase after initial access is established:
1. **Initial Access** (phishing, VPN compromise, MSP pivot)
2. **Privilege Escalation** (credential theft, Kerberoasting)
3. **AD Reconnaissance** ← csvde.exe HERE — dump entire directory structure
4. **Lateral Movement** (use discovered accounts/groups to pivot)
5. **Objective** (data theft, ransomware deployment, persistent access)
**RELATED AD RECON TOOLS IN LOLBIN ECOSYSTEM:**
- **dsquery** — LDAP query tool (also built-in, used by APT41, Ke3chang)
- **dsget** — AD object attribute retrieval
- **ldifde** — LDAP Data Interchange Format export (companion to
Target sectors: Financial Services, Technology, Government, Managed Service Providers, Healthcare, Energy, Retail
Target regions: North America, Europe, Asia-Pacific, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, HIGH, threat intelligence, cybersecurity, T1087.002, T1069.002, T1213, T1018, T1482, T1218, T1074.001, T1558.003, T1059.003, T1087.001