Hayabusa high test sigma

HackTool - SOAPHound Execution

Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 4688,
    "Channel": "Security"
  },
  "selection_1": {
    "CommandLine
| contains": [
      " --buildcache ",
      " --bhdump ",
      " --certdump ",
      " --dnsdump "
    ]
  },
  "selection_2": {
    "CommandLine
| contains": [
      " -c ",
      " --cachefilename ",
      " -o ",
      " --outputdirectory"
    ]
  },
  "condition": "process_creation and (all of selection_*)"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...