huntrule

Windows: Detect Ldifde.exe LDAP import (-i -f) usage

Flags Ldifde.exe being run with LDAP import parameters (-i and -f) that may trigger remote content retrieval.

FreeReviewedSigma · Medium · v2
Product
windows
Category
process_creation
Author
@gott_cyber (SigmaHQ), DRL 1.1
Published
2022-09-02
Updated
2026-07-31
AnalysisDetection
title: "Windows: Detect Ldifde.exe LDAP import (-i -f) usage"
id: 6a34276a-7bcb-4caa-a321-34c72aff873a
status: test
description: This rule identifies execution of Ldifde.exe using the LDAP import mode with the flags -i and -f. Attackers may abuse this utility to pass HTTP-based inputs that can trigger remote file retrieval. It relies on Windows process creation telemetry, including the executable name and the full command line arguments.
references:
  - https://twitter.com/0gtweet/status/1564968845726580736
  - https://strontic.github.io/xcyclopedia/library/ldifde.exe-979DE101F5059CEC1D2C56967CA2BAC0.html
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ldifde_file_load.yml
author: "@gott_cyber, Huntrule Team"
date: 2022-09-02
modified: 2023-03-14
tags:
  - attack.command-and-control
  - attack.stealth
  - attack.t1218
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \ldifde.exe
    - OriginalFileName: ldifde.exe
  selection_cli:
    CommandLine|contains|all:
      - -i
      - -f
  condition: all of selection_*
falsepositives:
  - Since the content of the files are unknown, false positives are expected
level: medium
license: DRL-1.1
related:
  - id: 6f535e01-ca1f-40be-ab8d-45b19c0c8b7f
    type: derived