huntrule

Windows Process Creation: SOAPHound Execution via AD Data Collection Command-Line Arguments

Flags SOAPHound execution on Windows by detecting command-line arguments used for Active Directory data collection.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
@kostastsale (SigmaHQ), DRL 1.1
Published
2024-01-26
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Discovery

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies execution of the SOAPHound .NET tool on Windows by matching specific command-line arguments related to building a cache and dumping Active Directory data such as BHD, certificates, and DNS records. Attackers and operators may use such tooling to collect sensitive AD information for discovery and follow-on attacks. The detection relies on Windows process creation telemetry with full command-line visibility.

Reporting behind it

Related detections9 linkedT1087 — drag to rearrange
Suspicious Active Directory Discovery via ADFind
Suspicious Active Directory Enumeration via Sysinternals AD Explorer Snapshot (via process_creation)
Suspicious SimpleHelp Remote Access Client Spawning Discovery Commands (via process_creation)
Uncommon ADWS (Port 9389) Connections from Non-Standard Windows Binaries
Windows Process Creation Signals for Pikabot System Discovery
Windows PowerShell module commandlet names matching known exploitation and post-exploitation tooling
Windows Process Creation: Suspicious PowerShell Commandlets Used by Known Exploitation Tools
Windows Process Creation: Seatbelt.exe PUA Discovery Command-Line Execution
Windows Process Creation: China Chopper Webshell Command Pattern via W3WP
Windows Process Creation: SOAPHound Execution via AD Data Collection Command-Line Arguments
Pivot detection · T1087 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.