HackTool - SharpLDAPmonitor Execution

Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects.

Detection logic

selection_img

- Image|endswith: \SharpLDAPmonitor.exe
- OriginalFileName: SharpLDAPmonitor.exe

selection_cli

CommandLine|contains|all:
  - "/user:"
  - "/pass:"
  - "/dcip:"

Condition

1 of selection_*

Raw YAML

title: HackTool - SharpLDAPmonitor Execution
id: 9f8fc146-1d1a-4dbf-b8fd-dfae15e08541
status: test
description: Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects.
references:
    - https://github.com/p0dalirius/LDAPmonitor
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-30
modified: 2023-02-14
tags:
    - attack.discovery
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\SharpLDAPmonitor.exe'
        - OriginalFileName: 'SharpLDAPmonitor.exe'
    selection_cli:
        CommandLine|contains|all:
            - '/user:'
            - '/pass:'
            - '/dcip:'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium

False positives

Unknown

References

https://github.com/p0dalirius/LDAPmonitor

Similar rules

AADInternals PowerShell Cmdlets Execution - ProccessCreation

high

windows · Same logsource category (process_creation)

Active Directory Database Snapshot Via ADExplorer

medium

windows · Same logsource category (process_creation)

Active Directory Structure Export Via Csvde.EXE

medium

windows · Same logsource category (process_creation)

Chopper Webshell Process Pattern

high

windows · Same logsource category (process_creation)