CSVDE.exe LOLBIN for AD Reconnaissance — FIN7 and APT10 Weaponize Built-In Windows Tool

Why CSVDE.exe Evades Detection

1. Microsoft-signed binary — Ships with Windows Server, signed by Microsoft. Default AV and EDR policies do not flag it.
2. Legitimate administrative use — AD administrators use CSVDE for provisioning, migrations, and auditing. Distinguishing malicious from legitimate execution requires behavioral context.
3. No external download — Already present on target systems. No need to transfer tools that might trigger network-based detections.
4. Complete output — A single csvde -f output.csv command exports the entire directory.
5. Parseable format — CSV output feeds directly into automated attack pipelines for target selection.

Attack Chain

1. Initial Access — Spear-phishing (FIN7 automotive campaign), VPN compromise, or MSP pivot (APT10 Cloud Hopper)
2. Credential Access — Stolen credentials or Kerberos ticket abuse provide domain-joined context
3. Discovery — csvde.exe -f output.csv dumps the full AD structure; -r filters target specific object classes
4. Data Staging — CSV output staged locally (T1074.001) for parsing and target selection
5. Lateral Movement — Discovered accounts, groups, and trust relationships enable hopping boxes via SMB (T1021.002)
6. Objective — Pulling data out (APT10), financial fraud (FIN7), or ransomware staging

Threat Actor Profile

FIN7 (Carbanak / Carbon Spider / ELBRUS)

FIN7 is a financially motivated threat group active since at least 2013. In April 2024, BlackBerry documented a campaign targeting the US automotive industry where FIN7 used csvde.exe alongside 3CF9.ps1 PowerShell scripts and the WsTaskLoad executable for Active Directory enumeration. MITRE ATT&CK T1087.002 formally attributes csvde.exe usage to FIN7: "FIN7 has also used csvde.exe, which is a built-in Windows command line tool, to export Active Directory information."

FIN7 primarily targets the US retail, hospitality, financial, and automotive sectors. The group has historically used sophisticated spear-phishing with malicious documents, point-of-sale malware, and Carbanak/Cobalt Strike backdoors.

APT10 / menuPass (Stone Panda / Red Apollo / CVNX)

APT10 is a China-nexus espionage group responsible for Operation Cloud Hopper (2016-2017), a large-scale campaign targeting managed IT service providers (MSPs) globally. PwC UK's Cloud Hopper Technical Annex (April 2017) specifically documents APT10's use of csvde.exe for Active Directory data export after gaining access through compromised MSPs. The BAE Systems analysis confirmed the MSP supply-chain methodology.

APT10 used MSP access to pivot into customer networks across the pharmaceutical, engineering, automotive, and government sectors. A LOLBin-heavy approach — csvde.exe provided the AD reconnaissance foundation for identifying high-value targets within each compromised customer environment. From a detection engineering perspective, the Cloud Hopper intrusions showed that MSP-to-customer pivots make CSVDE execution even harder to spot: the tool runs on servers where AD administration is expected.

Detection

Catching CSVDE.exe abuse takes a layered approach: process creation monitoring, LDAP query volume analysis, and first-time execution anomaly detection. Legitimate use is rare. When we ran these queries against production data, the false positive rate was near zero — most AD admins have moved to PowerShell cmdlets or ADUC years ago.

Threadlinqs Intelligence tracks 9 production-ready detection rules for this threat across SPL, KQL, and Sigma.

Splunk SPL

Watch for csvde.exe process creation with the export flag (-f) — that flag means AD data is being staged to disk.

Microsoft KQL

KQLlet baseline = DeviceProcessEvents
  | where Timestamp > ago(30d) and Timestamp < ago(1d)
  | where FileName =~ "csvde.exe"
  | distinct DeviceName;
DeviceProcessEvents
  | where Timestamp > ago(1d)
  | where FileName =~ "csvde.exe"
  | where DeviceName !in (baseline)
  | project Timestamp, DeviceName, ProcessCommandLine, AccountName,
    InitiatingProcessFileName, InitiatingProcessCommandLine

KQLlet csvde_exec = DeviceProcessEvents
  | where Timestamp > ago(7d)
  | where FileName =~ "csvde.exe"
  | project csvde_time = Timestamp, DeviceName;
DeviceFileEvents
  | where Timestamp > ago(7d)
  | where FileName endswith ".csv"
  | join kind=inner (csvde_exec) on DeviceName
  | where Timestamp between (csvde_time .. (csvde_time + 5m))
  | project Timestamp, DeviceName, FileName, FolderPath, FileSize

Sigma

SIGMAtitle: CSVDE.exe Targeted AD Export with LDAP Filter
id: c7a3f1e2-9b45-4d8a-a6e1-3f2c8d7b9e04
status: experimental
description: |
  Detects csvde.exe execution with export and LDAP filter flags indicating
  targeted Active Directory data extraction. SPN enumeration via
  -r servicePrincipalName is a kerberoasting precursor. Used by FIN7 and
  APT10/menuPass for AD reconnaissance.
references:
    - https://intel.threadlinqs.com/#TL-2026-0113
    - https://attack.mitre.org/techniques/T1087/002/
    - https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry
author: Threadlinqs Intelligence
date: 2026/02/22
tags:
    - attack.discovery
    - attack.t1087.002
    - attack.credential_access
    - attack.t1558.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\csvde.exe'
        - OriginalFileName: 'csvde.exe'
    selection_export:
        CommandLine|contains:
            - ' -f '
    selection_filter:
        CommandLine|contains:
            - ' -r '
            - ' -l '
            - ' -p '
            - ' -s '
    filter_import:
        CommandLine|contains: ' -i'
    condition: selection_img and selection_export and selection_filter and not filter_import
falsepositives:
    - Planned AD migration with specific LDAP filters
    - AD audit scripts using csvde for scheduled exports
level: high

Browse all 9 detection rules for this threat: View on Threadlinqs Intelligence

Indicators of Compromise

Behavioral Indicators

LOLBIN Ecosystem Context

MITRE ATT&CK Mapping

Full MITRE ATT&CK mapping: View coverage on Threadlinqs

Recommendations

1. Deploy process creation monitoring for csvde.exe — any execution with the -f flag should generate a HIGH alert in environments where AD administrators do not use this tool
2. Implement application control via Windows Defender Application Control (WDAC) or AppLocker to restrict csvde.exe execution to authorized administrative accounts
3. Enable LDAP query auditing on domain controllers (Event ID 1644) to detect bulk directory queries regardless of the tool used
4. Establish a LOLBIN baseline for csvde.exe, dsquery.exe, dsget.exe, ldifde.exe, and nltest.exe — alert on first-time use or execution by non-administrative accounts
5. Adopt tiered administration — Tier 0 (DC admin), Tier 1 (server admin), Tier 2 (workstation admin) — to limit the value an attacker gains from AD reconnaissance

References

• MITRE ATT&CK T1087.002 — Account Discovery: Domain Account — MITRE, 2024
• FIN7 Targets the United States Automotive Industry — BlackBerry, April 2024
• Operation Cloud Hopper Technical Annex — PwC UK, April 2017
• Operation Cloud Hopper — APT10 — BAE Systems, 2017
• Microsoft Csvde Command Reference) — Microsoft
• LOLBAS Project — Living Off The Land Binaries and Scripts — LOLBAS Project
• MITRE ATT&CK T1069.002 — Permission Groups Discovery: Domain Groups — MITRE
• Active Directory Structure Export Via Csvde.EXE — Sigma Rule — SigmaHQ

Full threat intelligence, detection rules, and IOC feeds are available on Threadlinqs Intelligence. Track this threat: TL-2026-0113.