Windows ADSI Schema Cache (.sch) File Creation by Uncommon Process
Alerts on .sch cache file creation in the Windows SchCache directory by uncommon executables.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- file_event
- Author
- xknow @xknow_infosec, Tim Shelton (SigmaHQ), DRL 1.1
- Published
- 2019-03-24
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags creation of Active Directory Schema Cache File (.sch) artifacts under the Local\Microsoft\Windows\SchCache path when the creating process is not on a known-allowlist. Attackers may generate these cache files as part of directory/AD-related operations, including tooling used for LDAP/AD interactions. It relies on Windows file creation telemetry that captures the target filename and the creating process image path.
Reporting behind it
- medium.comhttps://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961
- blog.fox-it.comhttps://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/
- github.comhttps://github.com/fox-it/LDAPFragger
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_adsi_cache_creation_by_uncommon_tool.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-adsi-schema-cache-sch-file-creation-by-uncommon-executables-75bf09fa
title: Windows ADSI Schema Cache (.sch) File Creation by Uncommon Process
id: 02ff8d4c-85ff-4c05-87a8-415bb56cd5e7
status: test
description: This rule flags creation of Active Directory Schema Cache File (.sch) artifacts under the Local\Microsoft\Windows\SchCache path when the creating process is not on a known-allowlist. Attackers may generate these cache files as part of directory/AD-related operations, including tooling used for LDAP/AD interactions. It relies on Windows file creation telemetry that captures the target filename and the creating process image path.
references:
- https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961
- https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/
- https://github.com/fox-it/LDAPFragger
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_adsi_cache_creation_by_uncommon_tool.yml
author: xknow @xknow_infosec, Tim Shelton, Huntrule Team
date: 2019-03-24
modified: 2023-10-18
tags:
- attack.t1001.003
- attack.command-and-control
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|contains: \Local\Microsoft\Windows\SchCache\
TargetFilename|endswith: .sch
filter_main_generic:
- Image|endswith:
- :\Program Files\Cylance\Desktop\CylanceSvc.exe
- :\Windows\CCM\CcmExec.exe
- :\windows\system32\dllhost.exe
- :\Windows\system32\dsac.exe
- :\Windows\system32\efsui.exe
- :\windows\system32\mmc.exe
- :\windows\system32\svchost.exe
- :\Windows\System32\wbem\WmiPrvSE.exe
- :\windows\system32\WindowsPowerShell\v1.0\powershell.exe
- Image|contains:
- :\Windows\ccmsetup\autoupgrade\ccmsetup
- :\Program Files\SentinelOne\Sentinel Agent
filter_main_office:
Image|contains|all:
- :\Program Files\
- \Microsoft Office
Image|endswith: \OUTLOOK.EXE
filter_optional_ldapwhoami:
Image|endswith: \LANDesk\LDCLient\ldapwhoami.exe
filter_optional_citrix:
Image|endswith: :\Program Files\Citrix\Receiver StoreFront\Services\DefaultDomainServices\Citrix.DeliveryServices.DomainServices.ServiceHost.exe
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Other legimate tools, which do ADSI (LDAP) operations, e.g. any remoting activity by MMC, Powershell, Windows etc.
level: medium
license: DRL-1.1
related:
- id: 75bf09fa-1dd7-4d18-9af9-dd9e492562eb
type: derived