Windows ADSI Schema Cache (.sch) File Creation by Uncommon Executables

title: Windows ADSI Schema Cache (.sch) File Creation by Uncommon Executables
id: 02ff8d4c-85ff-4c05-87a8-415bb56cd5e7
status: test
description: This rule flags creation of an Active Directory Schema Cache file under \Local\Microsoft\Windows\SchCache with a .sch extension, when the creating process is not in a set of common Windows and security/management executables. Attackers may generate these cache files as part of directory/ADSI interactions during discovery or command-and-control workflows. Telemetry relies on Windows file creation events that include the target filename path and the creating process image.
references:
  - https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961
  - https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/
  - https://github.com/fox-it/LDAPFragger
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_adsi_cache_creation_by_uncommon_tool.yml
author: xknow @xknow_infosec, Tim Shelton, Huntrule Team
date: 2019-03-24
modified: 2023-10-18
tags:
  - attack.t1001.003
  - attack.command-and-control
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains: \Local\Microsoft\Windows\SchCache\
    TargetFilename|endswith: .sch
  filter_main_generic:
    - Image|endswith:
        - :\Program Files\Cylance\Desktop\CylanceSvc.exe
        - :\Windows\CCM\CcmExec.exe
        - :\windows\system32\dllhost.exe
        - :\Windows\system32\dsac.exe
        - :\Windows\system32\efsui.exe
        - :\windows\system32\mmc.exe
        - :\windows\system32\svchost.exe
        - :\Windows\System32\wbem\WmiPrvSE.exe
        - :\windows\system32\WindowsPowerShell\v1.0\powershell.exe
    - Image|contains:
        - :\Windows\ccmsetup\autoupgrade\ccmsetup
        - :\Program Files\SentinelOne\Sentinel Agent
  filter_main_office:
    Image|contains|all:
      - :\Program Files\
      - \Microsoft Office
    Image|endswith: \OUTLOOK.EXE
  filter_optional_ldapwhoami:
    Image|endswith: \LANDesk\LDCLient\ldapwhoami.exe
  filter_optional_citrix:
    Image|endswith: :\Program Files\Citrix\Receiver StoreFront\Services\DefaultDomainServices\Citrix.DeliveryServices.DomainServices.ServiceHost.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Other legimate tools, which do ADSI (LDAP) operations, e.g. any remoting activity by MMC, Powershell, Windows etc.
level: medium
license: DRL-1.1
related:
  - id: 75bf09fa-1dd7-4d18-9af9-dd9e492562eb
    type: derived