Windows: Detect ldifde.exe Export of Active Directory via -f

title: "Windows: Detect ldifde.exe Export of Active Directory via -f"
id: 86805c74-18b1-4ae2-9c76-65a40d2befcc
status: test
description: This rule identifies execution of ldifde.exe with command-line arguments containing "-f", indicating an Active Directory data export. Exporting directory structure can enable discovery of users, groups, and configuration details for follow-on access or exfiltration. Telemetry relies on Windows process creation events and inspects the process image/original file name along with the command line.
references:
  - https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit
  - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ldifde_export.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-14
tags:
  - attack.exfiltration
logsource:
  category: process_creation
  product: windows
detection:
  selection_ldif:
    - Image|endswith: \ldifde.exe
    - OriginalFileName: ldifde.exe
  selection_cmd:
    CommandLine|contains: -f
  filter_import:
    CommandLine|contains: " -i"
  condition: all of selection_* and not 1 of filter_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4f7a6757-ff79-46db-9687-66501a02d9ec
    type: derived