Windows: Detect Ldifde.exe LDAP import (-i -f) usage
Flags Ldifde.exe being run with LDAP import parameters (-i and -f) that may trigger remote content retrieval.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- process_creation
- Author
- @gott_cyber (SigmaHQ), DRL 1.1
- Published
- 2022-09-02
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies execution of Ldifde.exe using the LDAP import mode with the flags -i and -f. Attackers may abuse this utility to pass HTTP-based inputs that can trigger remote file retrieval. It relies on Windows process creation telemetry, including the executable name and the full command line arguments.
Reporting behind it
- twitter.comhttps://twitter.com/0gtweet/status/1564968845726580736
- strontic.github.iohttps://strontic.github.io/xcyclopedia/library/ldifde.exe-979DE101F5059CEC1D2C56967CA2BAC0.html
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ldifde_file_load.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-ldifde-exe-ldap-import-i-f-execution-6f535e01
title: "Windows: Detect Ldifde.exe LDAP import (-i -f) usage"
id: 6a34276a-7bcb-4caa-a321-34c72aff873a
status: test
description: This rule identifies execution of Ldifde.exe using the LDAP import mode with the flags -i and -f. Attackers may abuse this utility to pass HTTP-based inputs that can trigger remote file retrieval. It relies on Windows process creation telemetry, including the executable name and the full command line arguments.
references:
- https://twitter.com/0gtweet/status/1564968845726580736
- https://strontic.github.io/xcyclopedia/library/ldifde.exe-979DE101F5059CEC1D2C56967CA2BAC0.html
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ldifde_file_load.yml
author: "@gott_cyber, Huntrule Team"
date: 2022-09-02
modified: 2023-03-14
tags:
- attack.command-and-control
- attack.stealth
- attack.t1218
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \ldifde.exe
- OriginalFileName: ldifde.exe
selection_cli:
CommandLine|contains|all:
- -i
- -f
condition: all of selection_*
falsepositives:
- Since the content of the files are unknown, false positives are expected
level: medium
license: DRL-1.1
related:
- id: 6f535e01-ca1f-40be-ab8d-45b19c0c8b7f
type: derived