CSVDE.exe LOLBIN for Active Directory Reconnaissance — FIN7 + APT10/menuPass Documented Usage, Bulk LDAP Export, Kerberoasting Precursor
CSVDE.exe LOLBIN for Active Directory Reconnaissance (TL-2026-0113) is a high-severity advanced persistent threat campaign, first published 2026-02-16. It is attributed to FIN7 (China) with high confidence, maps to 17 MITRE ATT&CK techniques (T1016, T1018, T1021.002), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0113
- Threat ID
- TL-2026-0113
- Severity
- HIGH
- Status
- MONITORING
- Category
- APT
- First published
- 2026-02-16
- Last reviewed
- 2026-02-16
- Attribution
- FIN7
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE|FINANCIAL
- Target sectors
- Financial Services, Technology, Government, Managed Service Providers, Healthcare, Energy, Retail
- Target regions
- North America, Europe, Asia-Pacific, Global
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in CSVDE.exe LOLBIN for Active Directory Reconnaissance
Malware and tooling: CSVDE
CSVDE.exe (csvde.exe) is a legitimate Windows Server utility for importing/exporting Active Directory data via LDAP to CSV format, weaponized as a Living-off-the-Land Binary (LOLBIN) for AD reconnaissance and directory dumping by nation-state APTs and financial cybercrime groups. Documented usage by FIN7 (financial crime) and APT10/menuPass (China-nexus espionage via Operation Cloud Hopper). Ships with Windows Server as part of AD DS/AD LDS tools.
How CSVDE.exe LOLBIN for Active Directory Reconnaissance works
CSVDE.exe is a command-line utility built into Windows Server (located in %windir%\system32) that imports and exports Active Directory Domain Services (AD DS) data using LDAP and CSV file format. It has been weaponized as a Living-off-the-Land Binary (LOLBIN) by sophisticated threat actors for Active Directory reconnaissance and bulk directory data exfiltration.
**V1 ASSESSMENT: The v1 title 'CSVDE.exe LDAP Directory Dumping Campaign' frames this as a specific campaign. There is NO single 'CSVDE campaign' — rather, csvde.exe is a TECHNIQUE used across multiple unrelated campaigns by different threat actors. The tool itself and its abuse are REAL and well-documented. This entry covers csvde.exe as an AD reconnaissance LOLBIN technique with documented APT usage.**
**DOCUMENTED APT USAGE (MITRE ATT&CK verified):**
1. **FIN7 (Carbanak Group)** — Financial cybercrime group. MITRE ATT&CK T1087.002 documents: 'FIN7 has also used csvde.exe, which is a built-in Windows command line tool, to export Active Directory information.' Used alongside net group, 3CF9.ps1 PowerShell scripts, and WsTaskLoad executable. FIN7 targets US automotive, retail, hospitality, and financial sectors. Source: BlackBerry April 2024 report on FIN7 targeting US automotive industry.
2. **menuPass / APT10 (Stone Panda, CVNX)** — China-nexus espionage group. MITRE ATT&CK T1087.002 documents: 'menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.' Used during Operation Cloud Hopper (2016-2017), a massive campaign targeting managed IT service providers (MSPs) to access their customers' networks. Source: PwC UK 'Operation Cloud Hopper Technical Annex' April 2017.
**CSVDE.exe CAPABILITIES (as LOLBIN):** - **Bulk AD Export:** `csvde -f output.csv` exports ALL Active Directory objects to CSV - **Targeted LDAP Queries:** `-r` flag allows LDAP filter (e.g., `csvde -r (objectClass=User) -f users.csv` exports all users) - **Attribute Selection:** `-l` flag selects specific attributes (e.g., `csvde -l sAMAccountName,CN,distinguishedName -f admins.csv`) - **Scope Control:** `-p` flag controls search scope (Base, OneLevel, SubTree) - **Remote DC Targeting:** `-s` flag targets specific domain controllers - **Alternative Credentials:** `-a` and `-b` flags allow authentication with different credentials - **Binary Value Handling:** `-n` omits binary values for cleaner output - **Port Selection:** `-t` flag allows targeting LDAP (389) or Global Catalog (3268)
**WHY CSVDE IS EFFECTIVE AS A LOLBIN:** 1. **Microsoft-signed:** Ships with Windows Server, signed by Microsoft. Not flagged by default AV/EDR. 2. **Legitimate use:** AD administrators use csvde for user provisioning, auditing, migrations. Hard to distinguish malicious from legitimate use. 3. **No download required:** Already present on Windows Server systems with AD DS/AD LDS role. 4. **Comprehensive output:** Single command exports entire directory — user accounts, groups, OUs, computers, service accounts. 5. **LDAP native:** Direct LDAP queries mean results include all queryable attributes including those not visible in GUI tools. 6. **CSV format:** Output is easily parseable for automated processing — attacker pipelines can immediately extract high-value targets (Domain Admins, service accounts with SPNs).
**ATTACK CHAIN CONTEXT:** csvde.exe is typically used in the DISCOVERY phase after initial access is established: 1. **Initial Access** (phishing, VPN compromise, MSP pivot) 2. **Privilege Escalation** (credential theft, Kerberoasting) 3. **AD Reconnaissance** ← csvde.exe HERE — dump entire directory structure 4. **Lateral Movement** (use discovered accounts/groups to pivot) 5. **Objective** (data theft, ransomware deployment, persistent access)
**RELATED AD RECON TOOLS IN LOLBIN ECOSYSTEM:** - **dsquery** — LDAP query tool (also built-in, used by APT41, Ke3chang) - **dsget** — AD object attribute retrieval - **ldifde** — LDAP Data Interchange Format export (companion to csvde) - **net group /domain** — Group enumeration (used by 20+ APT groups) - **nltest** — Domain trust enumeration - **AdFind** — Third-party AD query tool (most popular, used by Ryuk, FIN6, BlackByte, Bumblebee) - **BloodHound/SharpHound** — AD relationship mapping
csvde.exe is LESS common than AdFind or net commands but MORE dangerous because it provides BULK export capability — a single command dumps the entire directory, not just targeted queries.
MITRE ATT&CK techniques used in TL-2026-0113
discovery
T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1033 System Owner/User Discovery; T1069.002 Domain Groups; T1087.001 Local Account; T1087.002 Domain Account; T1482 Domain Trust Discovery
lateral-movement
T1021.002 SMB/Windows Admin Shares
defense-evasion
T1036.003 Rename Legitimate Utilities; T1218 System Binary Proxy Execution
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1059.003 Windows Command Shell
collection
T1074.001 Local Data Staging; T1213 Data from Information Repositories
credential-access
T1110.003 Password Spraying; T1558.003 Kerberoasting; T1558.004 AS-REP Roasting
Remediation for CSVDE.exe LOLBIN for Active Directory Reconnaissance
Patches
- N/A — csvde.exe is a legitimate Microsoft tool, not a vulnerability to patch
Immediate actions
- MONITOR: Deploy detection rules for csvde.exe execution — process creation events with csvde.exe as the image/process name
- ALERT: Any csvde.exe execution with -f flag (file export) should generate a HIGH alert — legitimate AD admins rarely use csvde interactively
- AUDIT: Check Windows event logs and Sysmon for historical csvde.exe execution — may indicate prior compromise
- REVIEW: Identify which systems have csvde.exe installed (only Windows Servers with AD DS/AD LDS role)
Workarounds
- Rename or remove csvde.exe from systems where it is not needed (note: may break legitimate AD provisioning workflows)
- Use Software Restriction Policies or AppLocker to block csvde.exe for non-admin users
- Monitor LDAP query volume from individual hosts — bulk queries indicate reconnaissance
Longer-term hardening
- APPLICATION CONTROL: Use Windows Defender Application Control (WDAC) or AppLocker to restrict csvde.exe execution to authorized admin accounts only
- LDAP AUDITING: Enable LDAP query logging on domain controllers to detect bulk directory queries regardless of tool used
- LEAST PRIVILEGE: Restrict which accounts can perform LDAP searches against the entire directory — most users need only limited AD query access
- TIERED ACCESS: Implement tiered administration model — Tier 0 (DC admin), Tier 1 (server admin), Tier 2 (workstation admin) to limit AD reconnaissance value
- AD MONITORING: Deploy Microsoft ATA/Azure ATP/Defender for Identity to detect LDAP reconnaissance patterns
- LOLBIN BASELINE: Establish baseline for all built-in AD administration tools (csvde, dsquery, dsget, ldifde, nltest) — alert on first-time use by non-admin accounts
Timeline of CSVDE.exe LOLBIN for Active Directory Reconnaissance
- Microsoft introduces csvde.exe as part of Windows Server 2003 Active Directory administration tools. Ships in %windir%\system32 on systems with AD DS role installed. Designed for bulk import/export of AD objects in CSV format. Source: Microsoft documentation.
- APT10/menuPass launches Operation Cloud Hopper targeting managed IT service providers (MSPs) globally. Campaign uses MSP access to pivot into customer networks. csvde.exe used for Active Directory reconnaissance after gaining access. Source: PwC UK Cloud Hopper report.
- PwC UK publishes 'Operation Cloud Hopper Technical Annex' documenting APT10/menuPass tools and techniques. Report specifically identifies csvde.exe usage for AD data export during MSP compromise operations. Source: https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf
- BlackBerry publishes report on FIN7 targeting US automotive industry. Documents FIN7's use of csvde.exe alongside 3CF9.ps1 PowerShell scripts and WsTaskLoad for Active Directory enumeration. Source: BlackBerry blog April 2024.
- MITRE ATT&CK T1087.002 (Account Discovery: Domain Account) formally documents csvde.exe usage by both FIN7 and menuPass. Establishes csvde as a known LOLBIN for AD reconnaissance. Source: https://attack.mitre.org/techniques/T1087/002/
- csvde.exe recognized as part of the broader AD LOLBIN ecosystem alongside dsquery, dsget, ldifde, nltest, and net commands. All are Microsoft-signed, all ship with Windows Server, all are abused for AD reconnaissance. Source: LOLBAS Project, MITRE ATT&CK.
- csvde.exe abuse continues as a persistent AD reconnaissance technique. Unlike CVE-based threats that can be patched, LOLBIN abuse requires behavioral detection — the tool is legitimate, only the context of use is malicious. Organizations must monitor for unauthorized csvde.exe execution.
- As of 2026-05-29, csvde.exe AD-recon abuse remains a live LOLBIN technique (no CVE, nothing to patch); FIN7 stays operational despite 2018 arrests and APT10/menuPass (threat card updated Aug 2025) is still active. Defense is behavioral detection only, so the posture is ongoing monitoring rather than incident-driven ACTIVE per Sigma/MITRE T1087.002 coverage.
Sources cited for CSVDE.exe LOLBIN for Active Directory Reconnaissance
- MITRE ATT&CK T1087.002 — Account Discovery: Domain Account
- BlackBerry — FIN7 Targets US Automotive Industry (csvde.exe documented)
- PwC UK — Operation Cloud Hopper Technical Annex (APT10 csvde.exe usage)
- Microsoft — Csvde Command Reference
- MITRE ATT&CK T1069.002 — Permission Groups Discovery: Domain Groups
- LOLBAS Project — Living Off The Land Binaries and Scripts
More in apt
- Nation-State and Financially Motivated Actors Weaponize Claude AI Multi-Agent Frameworks for Automated Cyberattacks and Data Theft
- Midnight Blizzard (GTG-20006) Used Claude AI Agents to Automate Malware Evasion, Hijack Hotel Wi-Fi (CaptiveCrunch), and Take Over WhatsApp Accounts Against Ukrainian/European Government and Drone-Supply-Chain Targets
- Iran Exploits SS7 Roaming Infrastructure and Commercial Ad-Tech to Track US Military Smartphones During Operation Epic Fury
- China-Based AI Companies Conducting Industrial-Scale Knowledge Distillation Campaigns Against U.S. Frontier AI Models
- China-Nexus and India-Nexus Espionage Groups Converge on Pakistani Law Enforcement Digitalization Platforms ("One Target, Two Flags")
Detection coverage for TL-2026-0113
As of 2026-02-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0113 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.