{"id":"e92a4287-e072-4a40-9739-370c106bb750","title":"HackTool - SOAPHound Execution","description":"Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.\n","author":"@kostastsale","status":"test","level":"high","date":"2024-01-26","modified":"","tags":["attack.discovery","attack.t1087"],"technique_ids":["T1087"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://github.com/FalconForceTeam/SOAPHound","https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_soaphound_execution.yml","source_sha256":"65d504e7bceda074481b5185d65e12bab1ee0fd24b496bcbcbe33f01520be1ea","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_soaphound_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - SOAPHound Execution\nid: e92a4287-e072-4a40-9739-370c106bb750\nstatus: test\ndescription: |\n    Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.\nreferences:\n    - https://github.com/FalconForceTeam/SOAPHound\n    - https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c\nauthor: '@kostastsale'\ndate: 2024-01-26\ntags:\n    - attack.discovery\n    - attack.t1087\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_1:\n        CommandLine|contains:\n            - ' --buildcache '\n            - ' --bhdump '\n            - ' --certdump '\n            - ' --dnsdump '\n    selection_2:\n        CommandLine|contains:\n            - ' -c '\n            - ' --cachefilename '\n            - ' -o '\n            - ' --outputdirectory'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1087","id":"T1087","name":"Account Discovery","page":"techniques/enterprise/T1087/"}],"data_path":"data/detection-rules/e92a4287-e072-4a40-9739-370c106bb750.json","kind":"sigma"}