SharpLdapWhoami Tool Execution on Windows via Process Creation

Flags execution of SharpLdapWhoami on Windows using LDAP-related whoami alternative method parameters.

FreeUnreviewedSigmahighv1

sharpldapwhoami-tool-execution-on-windows-via-process-creation-d9367cbb

title: SharpLdapWhoami Tool Execution on Windows via Process Creation
id: 2d5e0eb5-903f-4fdc-9ec8-9ebdd767dd8e
status: test
description: This rule identifies execution of SharpLdapWhoami on Windows by matching the process image name or embedded product/original filename metadata and specific command-line method flags. Attackers can use this tool as a whoami alternative to enumerate identity information by querying LDAP on a domain controller, which supports discovery and post-exploitation planning. Telemetry relied on is Windows process creation events including the executable path/name, file metadata, and full command line.
references:
  - https://github.com/bugch3ck/SharpLdapWhoami
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharpldapwhoami.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-29
modified: 2023-02-04
tags:
  - attack.discovery
  - attack.t1033
  - car.2016-03-001
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith: \SharpLdapWhoami.exe
  selection_pe:
    - OriginalFileName|contains: SharpLdapWhoami
    - Product: SharpLdapWhoami
  selection_flags1:
    CommandLine|endswith:
      - " /method:ntlm"
      - " /method:kerb"
      - " /method:nego"
      - " /m:nego"
      - " /m:ntlm"
      - " /m:kerb"
  condition: 1 of selection*
falsepositives:
  - Programs that use the same command line flags
level: high
license: DRL-1.1
related:
  - id: d9367cbb-c2e0-47ce-bdc0-128cb6da898d
    type: derived

What it detects

This rule identifies execution of SharpLdapWhoami on Windows by matching the process image name or embedded product/original filename metadata and specific command-line method flags. Attackers can use this tool as a whoami alternative to enumerate identity information by querying LDAP on a domain controller, which supports discovery and post-exploitation planning. Telemetry relied on is Windows process creation events including the executable path/name, file metadata, and full command line.

Known false positives

Programs that use the same command line flags

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.