Windows file creation for SharpHound/BloodHound collection output filenames

Flags SharpHound/BloodHound default collection export files (zip and multiple JSON datasets) from Windows file events.

FreeUnreviewedSigmahighv1

windows-file-creation-for-sharphound-bloodhound-collection-output-filenames-02773bed

title: Windows file creation for SharpHound/BloodHound collection output filenames
id: abd214de-8d21-4a0f-8422-cb8727e74772
status: test
description: This rule identifies Windows file events whose target filenames match default BloodHound/SharpHound collection outputs, including BloodHound.zip and JSON exports for computers, containers, groups, OUs, and users. Attackers commonly collect directory data to enumerate and map Active Directory relationships, and these exported files provide a concrete artifact of that discovery activity. The detection relies on file event telemetry containing process image paths and target filenames.
references:
  - https://academy.hackthebox.com/course/preview/active-directory-bloodhound/bloodhound--data-collection
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_bloodhound_collection.yml
author: C.J. May, Huntrule Team
date: 2022-08-09
modified: 2026-02-19
tags:
  - attack.discovery
  - attack.t1087.001
  - attack.t1087.002
  - attack.t1482
  - attack.t1069.001
  - attack.t1069.002
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - BloodHound.zip
      - _computers.json
      - _containers.json
      - _gpos.json
      - _groups.json
      - _ous.json
      - _users.json
  filter_optional_ms_winapps:
    Image|endswith: \svchost.exe
    TargetFilename|startswith: C:\Program Files\WindowsApps\Microsoft.
    TargetFilename|endswith: \pocket_containers.json
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Some false positives may arise in some environment and this may require some tuning. Add additional filters or reduce level depending on the level of noise
level: high
license: DRL-1.1
related:
  - id: 02773bed-83bf-469f-b7ff-e676e7d78bab
    type: derived

What it detects

This rule identifies Windows file events whose target filenames match default BloodHound/SharpHound collection outputs, including BloodHound.zip and JSON exports for computers, containers, groups, OUs, and users. Attackers commonly collect directory data to enumerate and map Active Directory relationships, and these exported files provide a concrete artifact of that discovery activity. The detection relies on file event telemetry containing process image paths and target filenames.

Known false positives

Some false positives may arise in some environment and this may require some tuning. Add additional filters or reduce level depending on the level of noise

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.