Windows SharpLdapWhoami Execution via LDAP Whoami Methods

Flags execution of SharpLdapWhoami on Windows using LDAP-related whoami alternative method parameters.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-08-29
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1033System Owner/User Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags execution of SharpLdapWhoami on Windows when the process image or metadata indicates the tool. It further matches command lines using LDAP/NTLM/Kerberos negotiation methods such as /method:{ntlm,kerb,nego} and /m:{ntlm,kerb,nego}. This matters because the tool can be used to discover identity context by querying LDAP against a domain controller. Telemetry required includes Windows process creation data with image path, file name/product metadata, and full command-line arguments.

Reporting behind it

Related detections9 linkedT1033 — drag to rearrange

Suspicious Whoami Execution With Output Redirected to a File (via process_creation)

Possible Logged-On Session Discovery via Quser or Qwinsta (via process_creation)

Suspicious Reconnaissance Spawned by Injected SearchProtocolHost via process_creation

Windows Process Creation: whoami.exe Executed With /all for Full Identity Enumeration

Linux Process Execution of esxcli Network Commands for ESXi Network Discovery

Linux Process Execution of esxcli VM Listing Commands

Linux ESXi esxcli VSAN Information Discovery via esxcli Command

Linux Process Creation: ESXi esxcli system discovery via system namespace

Linux ESXi esxcli Storage Information Discovery via esxcli storage commands

Windows SharpLdapWhoami Execution via LDAP Whoami Methods

Pivot detection · T1033 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

sharpldapwhoami-tool-execution-on-windows-via-process-creation-d9367cbb

title: Windows SharpLdapWhoami Execution via LDAP Whoami Methods
id: 2d5e0eb5-903f-4fdc-9ec8-9ebdd767dd8e
status: test
description: This rule flags execution of SharpLdapWhoami on Windows when the process image or metadata indicates the tool. It further matches command lines using LDAP/NTLM/Kerberos negotiation methods such as /method:{ntlm,kerb,nego} and /m:{ntlm,kerb,nego}. This matters because the tool can be used to discover identity context by querying LDAP against a domain controller. Telemetry required includes Windows process creation data with image path, file name/product metadata, and full command-line arguments.
references:
  - https://github.com/bugch3ck/SharpLdapWhoami
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharpldapwhoami.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-29
modified: 2023-02-04
tags:
  - attack.discovery
  - attack.t1033
  - car.2016-03-001
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith: \SharpLdapWhoami.exe
  selection_pe:
    - OriginalFileName|contains: SharpLdapWhoami
    - Product: SharpLdapWhoami
  selection_flags1:
    CommandLine|endswith:
      - " /method:ntlm"
      - " /method:kerb"
      - " /method:nego"
      - " /m:nego"
      - " /m:ntlm"
      - " /m:kerb"
  condition: 1 of selection*
falsepositives:
  - Programs that use the same command line flags
level: high
license: DRL-1.1
related:
  - id: d9367cbb-c2e0-47ce-bdc0-128cb6da898d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL