Windows Active Directory Export Using csvde.exe

title: Windows Active Directory Export Using csvde.exe
id: c58231c8-4935-4f51-9ad4-739567f84182
status: test
description: This rule identifies execution of csvde.exe with command-line arguments consistent with exporting Active Directory data (specifically using the -f option). Attackers commonly use AD export utilities to collect directory information for discovery and potential exfiltration. It relies on process creation telemetry on Windows, matching on the process image/filename and relevant command-line parameters.
references:
  - https://www.cybereason.com/blog/research/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
  - https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
  - https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit
  - https://redcanary.com/blog/msix-installers/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_csvde_export.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-14
tags:
  - attack.exfiltration
  - attack.discovery
  - attack.t1087.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \csvde.exe
    - OriginalFileName: csvde.exe
  selection_remote:
    CommandLine|contains: " -f"
  filter_import:
    CommandLine|contains: " -i"
  condition: all of selection_* and not 1 of filter_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: e5d36acd-acb4-4c6f-a13f-9eb203d50099
    type: derived