Detection rules › Sigma

HackTool - SharpLDAPmonitor Execution

Status
test
Severity
medium
Log source
category process_creation, product windows
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects.

MITRE ATT&CK coverage

TacticTechniques
DiscoveryNo specific technique

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 1: Process creation

Rule body

title: HackTool - SharpLDAPmonitor Execution
id: 9f8fc146-1d1a-4dbf-b8fd-dfae15e08541
status: test
description: Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects.
references:
    - https://github.com/p0dalirius/LDAPmonitor
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-30
modified: 2023-02-14
tags:
    - attack.discovery
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\SharpLDAPmonitor.exe'
        - OriginalFileName: 'SharpLDAPmonitor.exe'
    selection_cli:
        CommandLine|contains|all:
            - '/user:'
            - '/pass:'
            - '/dcip:'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: condition

1 of selection_*

Stage 1: selection_img

selection_img:
    - Image|endswith: '\SharpLDAPmonitor.exe'
    - OriginalFileName: 'SharpLDAPmonitor.exe'

Stage 2: selection_cli

selection_cli:
    CommandLine|contains|all:
        - '/user:'
        - '/pass:'
        - '/dcip:'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
CommandLinematch
  • /dcip:
  • /pass: corpus 2 (sigma 2)
  • /user: corpus 7 (sigma 5, splunk 2)
field:"CommandLine" kind:match
Imageends_with
  • \SharpLDAPmonitor.exe
field:"Image" kind:ends_with value:"\SharpLDAPmonitor.exe"
OriginalFileNameeq
  • SharpLDAPmonitor.exe
field:"OriginalFileName" kind:eq value:"SharpLDAPmonitor.exe"