Query: detection rule: Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.
Matching passage: Sigma rule: Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.. Logsource: windows / file_event. Rule: title: ADSI-Cache File Creation By Uncommon Tool id: 75bf09fa-1dd7-4d18-9af9-dd9e492562eb status: test description: Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool. references: - https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961 - https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/ - https://github.com/fox-it/LDAPFragger author: xknow @xknow_infosec, Tim Shelton date: 2019-03-24 modified: 2023-10-18 tags: - attack.t1001.003 - attack.command-and-control logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Local\Microsoft\Windows\SchCache\ TargetFilename|endswith: .sch filter_main_generic: - Image|endswith: - :\Program Files\Cylance\Desktop\CylanceSvc.exe - :\Windows\CCM\CcmExec.exe - :\windows\system32\dllhost.exe - :\Windows\system32\dsac.exe - :\Windows\system32\efsui.exe - :\windows\system32\mmc.exe - :\windows\system32\svchost.exe - :\Windows\System32\wbem\WmiPrvSE.exe - :\windows\system32\WindowsPowerShell\v1.0\powershell.exe - Image|contains: - :\Windows\ccmsetup\autoupgrade\ccmsetup - :\Program Files\SentinelOne\Sentinel Agent filter_main_office: Image|contains|all: - :\Program Files\ - \Microsoft Office Image|endswith: \OUTLOOK.EXE filter_optional_ldapwhoami: Image|endswith: \LANDesk\LDCLient\ldapwhoami.exe filter_optional_citrix: Image|endswith: :\Program Files\Citrix\Receiver StoreFront\Services\DefaultDomainServices\Citrix.DeliveryServices.DomainServices.ServiceHost.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Other legimate tools, which do ADSI (LDAP) operations, e.g. any remoting activity by MMC, Powershell, Windows etc. level: medium
Near-miss passage: Sigma rule: Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process inj. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of Conhost.EXE id: 7dc2dedd-7603-461a-bc13-15803d132355 related: - id: dfa03a09-8b92-4d83-8e74-f72839b1c407 type: similar status: test description: Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity. references: - http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/ author: omkar72 date: 2020-10-25 modified: 2023-12-11 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \conhost.exe filter_main_conhost: Image|endswith: :\Windows\System32\conhost.exe filter_main_null: Image: null filter_main_empty: Image: '' filter_optional_provider: Provider_Name: SystemTraceProvider-Process condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium