Detection rules › Sigma

HackTool - SOAPHound Execution

Status
test
Severity
high
Log source
category process_creation, product windows
Author
@kostastsale
Source
github.com/SigmaHQ/sigma

Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.

MITRE ATT&CK coverage

TacticTechniques
Discovery

Telemetry coverage

Rule body

title: HackTool - SOAPHound Execution
id: e92a4287-e072-4a40-9739-370c106bb750
status: test
description: |
    Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.
references:
    - https://github.com/FalconForceTeam/SOAPHound
    - https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c
author: '@kostastsale'
date: 2024-01-26
tags:
    - attack.discovery
    - attack.t1087
logsource:
    product: windows
    category: process_creation
detection:
    selection_1:
        CommandLine|contains:
            - ' --buildcache '
            - ' --bhdump '
            - ' --certdump '
            - ' --dnsdump '
    selection_2:
        CommandLine|contains:
            - ' -c '
            - ' --cachefilename '
            - ' -o '
            - ' --outputdirectory'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_1

selection_1:
    CommandLine|contains:
        - ' --buildcache '
        - ' --bhdump '
        - ' --certdump '
        - ' --dnsdump '

Stage 2: selection_2

selection_2:
    CommandLine|contains:
        - ' -c '
        - ' --cachefilename '
        - ' -o '
        - ' --outputdirectory'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
CommandLinematch
  • --bhdump
  • --buildcache
  • --cachefilename
  • --certdump
  • --dnsdump
  • --outputdirectory
  • -c corpus 13 (sigma 13)
  • -o corpus 3 (sigma 3)
field:"CommandLine" kind:match