{"id":"02773bed-83bf-469f-b7ff-e676e7d78bab","title":"BloodHound Collection Files","description":"Detects default file names outputted by the BloodHound collection tool SharpHound","author":"C.J. May","status":"test","level":"high","date":"2022-08-09","modified":"2026-02-19","tags":["attack.discovery","attack.t1087.001","attack.t1087.002","attack.t1482","attack.t1069.001","attack.t1069.002","attack.execution","attack.t1059.001"],"technique_ids":["T1059.001","T1069.001","T1069.002","T1087.001","T1087.002","T1482"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Some false positives may arise in some environment and this may require some tuning. Add additional filters or reduce level depending on the level of noise"],"references":["https://academy.hackthebox.com/course/preview/active-directory-bloodhound/bloodhound--data-collection"],"source_path":"rules/windows/file/file_event/file_event_win_bloodhound_collection.yml","source_sha256":"9a10039f41f0f9ca5424571728d37838da43ca8aa84d44af4a0dc9166fc80969","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_bloodhound_collection.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: BloodHound Collection Files\nid: 02773bed-83bf-469f-b7ff-e676e7d78bab\nstatus: test\ndescription: Detects default file names outputted by the BloodHound collection tool SharpHound\nreferences:\n    - https://academy.hackthebox.com/course/preview/active-directory-bloodhound/bloodhound--data-collection\nauthor: C.J. May\ndate: 2022-08-09\nmodified: 2026-02-19\ntags:\n    - attack.discovery\n    - attack.t1087.001\n    - attack.t1087.002\n    - attack.t1482\n    - attack.t1069.001\n    - attack.t1069.002\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        TargetFilename|endswith:\n            - 'BloodHound.zip'\n            - '_computers.json'\n            - '_containers.json'\n            # - '_domains.json'  # prone to false positives with ProbabilisticRevealTokenRegistry function in Google Chrome\n            - '_gpos.json'\n            - '_groups.json'\n            - '_ous.json'\n            - '_users.json'\n    filter_optional_ms_winapps:\n        Image|endswith: '\\svchost.exe'\n        TargetFilename|startswith: 'C:\\Program Files\\WindowsApps\\Microsoft.'\n        TargetFilename|endswith: '\\pocket_containers.json'\n    condition: selection and not 1 of filter_optional_*\nfalsepositives:\n    - Some false positives may arise in some environment and this may require some tuning. Add additional filters or reduce level depending on the level of noise\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"},{"key":"enterprise/T1069.001","id":"T1069.001","name":"Local Groups","page":"techniques/enterprise/T1069.001/"},{"key":"enterprise/T1069.002","id":"T1069.002","name":"Domain Groups","page":"techniques/enterprise/T1069.002/"},{"key":"enterprise/T1087.001","id":"T1087.001","name":"Local Account","page":"techniques/enterprise/T1087.001/"},{"key":"enterprise/T1087.002","id":"T1087.002","name":"Domain Account","page":"techniques/enterprise/T1087.002/"},{"key":"enterprise/T1482","id":"T1482","name":"Domain Trust Discovery","page":"techniques/enterprise/T1482/"}],"data_path":"data/detection-rules/02773bed-83bf-469f-b7ff-e676e7d78bab.json","kind":"sigma"}