Detection rules › Sigma

HackTool - SOAPHound Execution

Status
test
Severity
high
Log source
product windows, category process_creation
Author
@kostastsale
Source
github.com/SigmaHQ/sigma

Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1087 Account Discovery

Event coverage

Rule body yaml

title: HackTool - SOAPHound Execution
id: e92a4287-e072-4a40-9739-370c106bb750
status: test
description: |
    Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.
references:
    - https://github.com/FalconForceTeam/SOAPHound
    - https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c
author: '@kostastsale'
date: 2024-01-26
tags:
    - attack.discovery
    - attack.t1087
logsource:
    product: windows
    category: process_creation
detection:
    selection_1:
        CommandLine|contains:
            - ' --buildcache '
            - ' --bhdump '
            - ' --certdump '
            - ' --dnsdump '
    selection_2:
        CommandLine|contains:
            - ' -c '
            - ' --cachefilename '
            - ' -o '
            - ' --outputdirectory'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_1

selection_1:
    CommandLine|contains:
        - ' --buildcache '
        - ' --bhdump '
        - ' --certdump '
        - ' --dnsdump '

Stage 2: selection_2

selection_2:
    CommandLine|contains:
        - ' -c '
        - ' --cachefilename '
        - ' -o '
        - ' --outputdirectory'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • --bhdump
  • --buildcache
  • --cachefilename
  • --certdump
  • --dnsdump
  • --outputdirectory
  • -c corpus 14 (sigma 13, elastic 1)
  • -o corpus 3 (sigma 3)