{"id":"6f535e01-ca1f-40be-ab8d-45b19c0c8b7f","title":"Import LDAP Data Interchange Format File Via Ldifde.EXE","description":"Detects the execution of \"Ldifde.exe\" with the import flag \"-i\". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.\n","author":"@gott_cyber","status":"test","level":"medium","date":"2022-09-02","modified":"2023-03-14","tags":["attack.command-and-control","attack.stealth","attack.t1218","attack.t1105"],"technique_ids":["T1105","T1218"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Since the content of the files are unknown, false positives are expected"],"references":["https://twitter.com/0gtweet/status/1564968845726580736","https://strontic.github.io/xcyclopedia/library/ldifde.exe-979DE101F5059CEC1D2C56967CA2BAC0.html","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)"],"source_path":"rules/windows/process_creation/proc_creation_win_ldifde_file_load.yml","source_sha256":"b7468ec311219b67e8e41dc725b79b0cfdf7b4ca34be490a0a531f8ad9a49a97","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_ldifde_file_load.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Import LDAP Data Interchange Format File Via Ldifde.EXE\nid: 6f535e01-ca1f-40be-ab8d-45b19c0c8b7f\nstatus: test\ndescription: |\n    Detects the execution of \"Ldifde.exe\" with the import flag \"-i\". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.\nreferences:\n    - https://twitter.com/0gtweet/status/1564968845726580736\n    - https://strontic.github.io/xcyclopedia/library/ldifde.exe-979DE101F5059CEC1D2C56967CA2BAC0.html\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)\nauthor: '@gott_cyber'\ndate: 2022-09-02\nmodified: 2023-03-14\ntags:\n    - attack.command-and-control\n    - attack.stealth\n    - attack.t1218\n    - attack.t1105\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\ldifde.exe'\n        - OriginalFileName: 'ldifde.exe'\n    selection_cli:\n        CommandLine|contains|all:\n            - '-i'\n            - '-f'\n    condition: all of selection_*\nfalsepositives:\n    - Since the content of the files are unknown, false positives are expected\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"},{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/6f535e01-ca1f-40be-ab8d-45b19c0c8b7f.json","kind":"sigma"}