Detection rules › Splunk

Detect SharpHound File Modifications

Author
Michael Haag, Splunk
Source
upstream

The following analytic detects the creation of files typically associated with SharpHound, a reconnaissance tool used for gathering domain and trust data. It leverages file modification events from the Endpoint.Filesystem data model, focusing on default file naming patterns like *_BloodHound.zip and various JSON files. This activity is significant as it indicates potential domain enumeration, which is a precursor to more targeted attacks. If confirmed malicious, an attacker could gain detailed insights into the domain structure, facilitating lateral movement and privilege escalation.

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1069.001 Permission Groups Discovery: Local Groups, T1069.002 Permission Groups Discovery: Domain Groups, T1087.001 Account Discovery: Local Account, T1087.002 Account Discovery: Domain Account, T1482 Domain Trust Discovery

Event coverage

ProviderEvent IDTitle
Sysmon11FileCreate

Stages and Predicates

Stage 1: tstats

tstats WHERE Filesystem.file_name IN ("*_computers.json", "*_containers.json", "*_domains.json", "*_gpos.json", "*_groups.json", "*_ous.json", "*_users.json", "*bloodhound.zip") BY Filesystem.action, Filesystem.dest, Filesystem.file_access_time, Filesystem.file_create_time, Filesystem.file_hash, Filesystem.file_modify_time, Filesystem.file_name, Filesystem.file_path, Filesystem.file_acl, Filesystem.file_size, Filesystem.process_guid, Filesystem.process_id, Filesystem.user, Filesystem.vendor_product

Stage 2: search

search

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Filesystem.file_namein
  • "*_computers.json"
  • "*_containers.json"
  • "*_domains.json"
  • "*_gpos.json"
  • "*_groups.json"
  • "*_ous.json"
  • "*_users.json"
  • "*bloodhound.zip"