BloodHound Collection Files

{
  "file_event": {
    "EventID": 11,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "TargetFilename
| endswith": [
      "BloodHound.zip",
      "_computers.json",
      "_containers.json",
      "_gpos.json",
      "_groups.json",
      "_ous.json",
      "_users.json"
    ]
  },
  "filter_optional_ms_winapps": {
    "Image
| endswith": "\\svchost.exe",
    "TargetFilename
| startswith": "C:\\Program Files\\WindowsApps\\Microsoft.",
    "TargetFilename
| endswith": "\\pocket_containers.json"
  },
  "condition": "file_event and (selection and not 1 of filter_optional_*)"
}

False Positives

• ⚠ Some false positives may arise in some environment and this may require some tuning. Add additional filters or reduce level depending on the level of noise