Windows: Detect csvde.exe Active Directory export to CSV
Flags csvde.exe executions on Windows that include -f, consistent with exporting Active Directory data for discovery.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-03-14
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of csvde.exe used to export Active Directory information to a file, based on process creation telemetry and specific command-line arguments. Attackers can use this to enumerate directory structure and prepare data for further discovery or exfiltration. The detection relies on matching the process image or OriginalFileName for csvde.exe and requiring the presence of a CSV export parameter (-f) while excluding import-style usage (-i).
Reporting behind it
- cybereason.comhttps://www.cybereason.com/blog/research/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
- web.archive.orghttps://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
- businessinsights.bitdefender.comhttps://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit
- redcanary.comhttps://redcanary.com/blog/msix-installers/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_csvde_export.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect csvde.exe Active Directory export to CSV"
id: c58231c8-4935-4f51-9ad4-739567f84182
status: test
description: This rule identifies execution of csvde.exe used to export Active Directory information to a file, based on process creation telemetry and specific command-line arguments. Attackers can use this to enumerate directory structure and prepare data for further discovery or exfiltration. The detection relies on matching the process image or OriginalFileName for csvde.exe and requiring the presence of a CSV export parameter (-f) while excluding import-style usage (-i).
references:
- https://www.cybereason.com/blog/research/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
- https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
- https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit
- https://redcanary.com/blog/msix-installers/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_csvde_export.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-14
tags:
- attack.exfiltration
- attack.discovery
- attack.t1087.002
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \csvde.exe
- OriginalFileName: csvde.exe
selection_remote:
CommandLine|contains: " -f"
filter_import:
CommandLine|contains: " -i"
condition: all of selection_* and not 1 of filter_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: e5d36acd-acb4-4c6f-a13f-9eb203d50099
type: derived