sigmamediumHunting

HackTool - SharpLDAPmonitor Execution

Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects.

Detection Query

selection_img:
  - Image|endswith: \SharpLDAPmonitor.exe
  - OriginalFileName: SharpLDAPmonitor.exe
selection_cli:
  CommandLine|contains|all:
    - "/user:"
    - "/pass:"
    - "/dcip:"
condition: 1 of selection_*

Author

Nasreddine Bencherchali (Nextron Systems)

Created

2022-12-30

Data Sources

windowsProcess Creation Events

Platforms

windows

References

https://github.com/p0dalirius/LDAPmonitor

Tags

attack.discovery

Raw Content

title: HackTool - SharpLDAPmonitor Execution
id: 9f8fc146-1d1a-4dbf-b8fd-dfae15e08541
status: test
description: Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects.
references:
    - https://github.com/p0dalirius/LDAPmonitor
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-30
modified: 2023-02-14
tags:
    - attack.discovery
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\SharpLDAPmonitor.exe'
        - OriginalFileName: 'SharpLDAPmonitor.exe'
    selection_cli:
        CommandLine|contains|all:
            - '/user:'
            - '/pass:'
            - '/dcip:'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium