Windows SharpLDAPmonitor HackTool Execution via Image Name and Credential/DC Flags
Flags SharpLDAPmonitor execution on Windows with LDAP-related command-line parameters.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-12-30
- Updated
- 2026-07-31
What it detects
This rule identifies execution of SharpLDAPmonitor on Windows by matching the executable name and by observing command-line parameters consistent with LDAP access (including /user:, /pass:, and /dcip:). Monitoring or interacting with directory objects can support reconnaissance and change tracking, so detecting this tool execution helps surface attacker-driven LDAP activity. It relies on process creation telemetry, including the process image name and command-line arguments.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
sharpldapmonitor-hacktool-execution-on-windows-9f8fc146
title: Windows SharpLDAPmonitor HackTool Execution via Image Name and Credential/DC Flags
id: e78d6978-be9e-407d-b495-5090fff5acad
status: test
description: This rule identifies execution of SharpLDAPmonitor on Windows by matching the executable name and by observing command-line parameters consistent with LDAP access (including /user:, /pass:, and /dcip:). Monitoring or interacting with directory objects can support reconnaissance and change tracking, so detecting this tool execution helps surface attacker-driven LDAP activity. It relies on process creation telemetry, including the process image name and command-line arguments.
references:
- https://github.com/p0dalirius/LDAPmonitor
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharp_ldap_monitor.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-30
modified: 2023-02-14
tags:
- attack.discovery
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith: \SharpLDAPmonitor.exe
- OriginalFileName: SharpLDAPmonitor.exe
selection_cli:
CommandLine|contains|all:
- "/user:"
- "/pass:"
- "/dcip:"
condition: 1 of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 9f8fc146-1d1a-4dbf-b8fd-dfae15e08541
type: derived