Windows AD Structure Export Using ldifde.exe with -f
Flags ldifde.exe executions using -f that indicate Active Directory structure export from a Windows host.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-03-14
- Updated
- 2026-07-31
What it detects
This rule flags Windows process executions where ldifde.exe is run with a command line containing -f, which is commonly used to export Active Directory objects and structure. Attackers may use this behavior to collect directory data for staging, reconnaissance, or exfiltration. The detection relies on process creation telemetry, specifically the executable path/name and the command-line arguments.
Reporting behind it
- businessinsights.bitdefender.comhttps://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit
- documentcloud.orghttps://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ldifde_export.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-detect-ldifde-exe-export-of-active-directory-via-f-4f7a6757
title: Windows AD Structure Export Using ldifde.exe with -f
id: 86805c74-18b1-4ae2-9c76-65a40d2befcc
status: test
description: This rule flags Windows process executions where ldifde.exe is run with a command line containing -f, which is commonly used to export Active Directory objects and structure. Attackers may use this behavior to collect directory data for staging, reconnaissance, or exfiltration. The detection relies on process creation telemetry, specifically the executable path/name and the command-line arguments.
references:
- https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit
- https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ldifde_export.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-14
tags:
- attack.exfiltration
logsource:
category: process_creation
product: windows
detection:
selection_ldif:
- Image|endswith: \ldifde.exe
- OriginalFileName: ldifde.exe
selection_cmd:
CommandLine|contains: -f
filter_import:
CommandLine|contains: " -i"
condition: all of selection_* and not 1 of filter_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 4f7a6757-ff79-46db-9687-66501a02d9ec
type: derived