Windows Process Creation: SOAPHound Execution via AD Data Collection Arguments

title: "Windows Process Creation: SOAPHound Execution via AD Data Collection Arguments"
id: 7c676d7a-8b26-4690-8b2b-0bd943bf5ab9
status: test
description: This rule identifies execution of the SOAPHound .NET tool on Windows by matching distinctive command-line argument fragments used for collecting Active Directory data. Attackers commonly use discovery tools like this to enumerate AD-related information and support subsequent credential access and lateral movement. The detection relies on Windows process creation telemetry with command-line strings containing the specified flags.
references:
  - https://github.com/FalconForceTeam/SOAPHound
  - https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_soaphound_execution.yml
author: "@kostastsale, Huntrule Team"
date: 2024-01-26
tags:
  - attack.discovery
  - attack.t1087
logsource:
  product: windows
  category: process_creation
detection:
  selection_1:
    CommandLine|contains:
      - " --buildcache "
      - " --bhdump "
      - " --certdump "
      - " --dnsdump "
  selection_2:
    CommandLine|contains:
      - " -c "
      - " --cachefilename "
      - " -o "
      - " --outputdirectory"
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e92a4287-e072-4a40-9739-370c106bb750
    type: derived