Windows ADSI Schema Cache (.sch) File Creation by Uncommon Process

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1001.003Protocol or Service Impersonation
Exfiltration
Impact

What it detects

This rule flags creation of Active Directory Schema Cache File (.sch) artifacts under the Local\Microsoft\Windows\SchCache path when the creating process is not on a known-allowlist. Attackers may generate these cache files as part of directory/AD-related operations, including tooling used for LDAP/AD interactions. It relies on Windows file creation telemetry that captures the target filename and the creating process image path.

Reporting behind it

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-adsi-schema-cache-sch-file-creation-by-uncommon-executables-75bf09fa

title: Windows ADSI Schema Cache (.sch) File Creation by Uncommon Process
id: 02ff8d4c-85ff-4c05-87a8-415bb56cd5e7
status: test
description: This rule flags creation of Active Directory Schema Cache File (.sch) artifacts under the Local\Microsoft\Windows\SchCache path when the creating process is not on a known-allowlist. Attackers may generate these cache files as part of directory/AD-related operations, including tooling used for LDAP/AD interactions. It relies on Windows file creation telemetry that captures the target filename and the creating process image path.
references:
  - https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961
  - https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/
  - https://github.com/fox-it/LDAPFragger
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_adsi_cache_creation_by_uncommon_tool.yml
author: xknow @xknow_infosec, Tim Shelton, Huntrule Team
date: 2019-03-24
modified: 2023-10-18
tags:
  - attack.t1001.003
  - attack.command-and-control
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains: \Local\Microsoft\Windows\SchCache\
    TargetFilename|endswith: .sch
  filter_main_generic:
    - Image|endswith:
        - :\Program Files\Cylance\Desktop\CylanceSvc.exe
        - :\Windows\CCM\CcmExec.exe
        - :\windows\system32\dllhost.exe
        - :\Windows\system32\dsac.exe
        - :\Windows\system32\efsui.exe
        - :\windows\system32\mmc.exe
        - :\windows\system32\svchost.exe
        - :\Windows\System32\wbem\WmiPrvSE.exe
        - :\windows\system32\WindowsPowerShell\v1.0\powershell.exe
    - Image|contains:
        - :\Windows\ccmsetup\autoupgrade\ccmsetup
        - :\Program Files\SentinelOne\Sentinel Agent
  filter_main_office:
    Image|contains|all:
      - :\Program Files\
      - \Microsoft Office
    Image|endswith: \OUTLOOK.EXE
  filter_optional_ldapwhoami:
    Image|endswith: \LANDesk\LDCLient\ldapwhoami.exe
  filter_optional_citrix:
    Image|endswith: :\Program Files\Citrix\Receiver StoreFront\Services\DefaultDomainServices\Citrix.DeliveryServices.DomainServices.ServiceHost.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Other legimate tools, which do ADSI (LDAP) operations, e.g. any remoting activity by MMC, Powershell, Windows etc.
level: medium
license: DRL-1.1
related:
  - id: 75bf09fa-1dd7-4d18-9af9-dd9e492562eb
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL