Title:
ADSI-Cache File Creation By Uncommon Tool
Status:
test
Description:Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.
References:
-https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961
-https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/
-https://github.com/fox-it/LDAPFragger
Author: xknow @xknow_infosec, Tim Shelton
Date: 2019-03-24
modified:2023-10-18
Tags:
- -'attack.t1001.003'
- -'attack.command-and-control'
Logsource:
- product: windows
- category: file_event
Detection:
selection:
TargetFilename|contains:
'\Local\Microsoft\Windows\SchCache\'
TargetFilename|endswith:
'.sch'
filter_main_generic:
- Image|endswith:
- ':\Program Files\Cylance\Desktop\CylanceSvc.exe'
- ':\Windows\CCM\CcmExec.exe'
- ':\windows\system32\dllhost.exe'
- ':\Windows\system32\dsac.exe'
- ':\Windows\system32\efsui.exe'
- ':\windows\system32\mmc.exe'
- ':\windows\system32\svchost.exe'
- ':\Windows\System32\wbem\WmiPrvSE.exe'
- ':\windows\system32\WindowsPowerShell\v1.0\powershell.exe'
- Image|contains:
- ':\Windows\ccmsetup\autoupgrade\ccmsetup'
- ':\Program Files\SentinelOne\Sentinel Agent'
filter_main_office:
Image|contains|all:
-':\Program Files\'
-'\Microsoft Office'
Image|endswith:
'\OUTLOOK.EXE'
filter_optional_ldapwhoami:
Image|endswith:
'\LANDesk\LDCLient\ldapwhoami.exe'
filter_optional_citrix:
Image|endswith:
':\Program Files\Citrix\Receiver StoreFront\Services\DefaultDomainServices\Citrix.DeliveryServices.DomainServices.ServiceHost.exe'
condition:
selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
-Other legimate tools, which do ADSI (LDAP) operations, e.g. any remoting activity by MMC, Powershell, Windows etc.
Level:
medium
