Windows file creation for SharpHound/BloodHound collection output filenames

Flags SharpHound/BloodHound default collection export files (zip and multiple JSON datasets) from Windows file events.

FreeReviewedSigma · High · v1

Product: windows
Category: file_event
Author: C.J. May (SigmaHQ), DRL 1.1
Published: 2022-08-09
Updated: 2026-07-30

ATT&CK techniques

Execution → Discovery

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows file events whose target filenames match default BloodHound/SharpHound collection outputs, including BloodHound.zip and JSON exports for computers, containers, groups, OUs, and users. Attackers commonly collect directory data to enumerate and map Active Directory relationships, and these exported files provide a concrete artifact of that discovery activity. The detection relies on file event telemetry containing process image paths and target filenames.

Reporting behind it

Related detections9 linkedT1069.002 — drag to rearrange

Windows PowerShell module commandlet names matching known exploitation and post-exploitation tooling

Windows Process Creation: Suspicious PowerShell Commandlets Used by Known Exploitation Tools

Windows Process Execution of Bloodhound/SharpHound Command-Line Collection Options

Windows PowerShell ScriptBlock detects known malicious commandlet names used by exploitation frameworks

Windows Process Creation: Execution of Net.exe or Net1.exe

Suspicious Group Discovery - Command (via process_creation)

Windows File Events: ADExplorer .dat Snapshot Written by ADExp.exe or ADExplorer.exe

Windows: Sysinternals ADExplorer invoked with snapshot flag to create AD database snapshot

Windows Process Creation: Sysinternals ADExplorer Snapshot Exports Active Directory Database

Windows file creation for SharpHound/BloodHound collection output filenames

Pivot detection · T1069.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-file-creation-for-sharphound-bloodhound-collection-output-filenames-02773bed

title: Windows file creation for SharpHound/BloodHound collection output filenames
id: abd214de-8d21-4a0f-8422-cb8727e74772
status: test
description: This rule identifies Windows file events whose target filenames match default BloodHound/SharpHound collection outputs, including BloodHound.zip and JSON exports for computers, containers, groups, OUs, and users. Attackers commonly collect directory data to enumerate and map Active Directory relationships, and these exported files provide a concrete artifact of that discovery activity. The detection relies on file event telemetry containing process image paths and target filenames.
references:
  - https://academy.hackthebox.com/course/preview/active-directory-bloodhound/bloodhound--data-collection
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_bloodhound_collection.yml
author: C.J. May, Huntrule Team
date: 2022-08-09
modified: 2026-02-19
tags:
  - attack.discovery
  - attack.t1087.001
  - attack.t1087.002
  - attack.t1482
  - attack.t1069.001
  - attack.t1069.002
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - BloodHound.zip
      - _computers.json
      - _containers.json
      - _gpos.json
      - _groups.json
      - _ous.json
      - _users.json
  filter_optional_ms_winapps:
    Image|endswith: \svchost.exe
    TargetFilename|startswith: C:\Program Files\WindowsApps\Microsoft.
    TargetFilename|endswith: \pocket_containers.json
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Some false positives may arise in some environment and this may require some tuning. Add additional filters or reduce level depending on the level of noise
level: high
license: DRL-1.1
related:
  - id: 02773bed-83bf-469f-b7ff-e676e7d78bab
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL