HackTool - SharpLdapWhoami Execution

Description

Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller

Query · sigma

selection_name:
  Image|endswith: \SharpLdapWhoami.exe
selection_pe:
- OriginalFileName|contains: SharpLdapWhoami
- Product: SharpLdapWhoami
selection_flags1:
  CommandLine|endswith:
  - ' /method:ntlm'
  - ' /method:kerb'
  - ' /method:nego'
  - ' /m:nego'
  - ' /m:ntlm'
  - ' /m:kerb'
condition: 1 of selection*

Known false positives

  • Programs that use the same command line flags
Raw source HackTool - SharpLdapWhoami Execution · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: HackTool - SharpLdapWhoami Execution
id: d9367cbb-c2e0-47ce-bdc0-128cb6da898d
status: test
description: Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller
references:
    - https://github.com/bugch3ck/SharpLdapWhoami
author: Florian Roth (Nextron Systems)
date: 2022-08-29
modified: 2023-02-04
tags:
    - attack.discovery
    - attack.t1033
    - car.2016-03-001
logsource:
    category: process_creation
    product: windows
detection:
    selection_name:
        Image|endswith: '\SharpLdapWhoami.exe'
    selection_pe: # in case the file has been renamed after compilation
        - OriginalFileName|contains: 'SharpLdapWhoami'
        - Product: 'SharpLdapWhoami'
    selection_flags1:
        CommandLine|endswith:
            - ' /method:ntlm'
            - ' /method:kerb'
            - ' /method:nego'
            - ' /m:nego'
            - ' /m:ntlm'
            - ' /m:kerb'
    condition: 1 of selection*
falsepositives:
    - Programs that use the same command line flags
level: high

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.