Sigma rule: BloodHound Collection Files

Rule

Title

BloodHound Collection Files

Status

test

Level

high

Author

C.J. May

Date

2022-08-09

Modified

2026-02-19

File

rules/windows/file/file_event/file_event_win_bloodhound_collection.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects default file names outputted by the BloodHound collection tool SharpHound

Log source

product

windows

category

file_event

Detection

selection:
    TargetFilename|endswith:
        - 'BloodHound.zip'
        - '_computers.json'
        - '_containers.json'
        # - '_domains.json'  # prone to false positives with ProbabilisticRevealTokenRegistry function in Google Chrome
        - '_gpos.json'
        - '_groups.json'
        - '_ous.json'
        - '_users.json'
filter_optional_ms_winapps:
    Image|endswith: '\svchost.exe'
    TargetFilename|startswith: 'C:\Program Files\WindowsApps\Microsoft.'
    TargetFilename|endswith: '\pocket_containers.json'
condition: selection and not 1 of filter_optional_*

False positives (as the rule lists them)

• Some false positives may arise in some environment and this may require some tuning. Add additional filters or reduce level depending on the level of noise

Tags

• attack.discovery
• attack.t1087.001
• attack.t1087.002
• attack.t1482
• attack.t1069.001
• attack.t1069.002
• attack.execution
• attack.t1059.001

MITRE ATT&CK ids this rule names

• T1059.001
• T1069.001
• T1069.002
• T1087.001
• T1087.002
• T1482

References

• https://academy.hackthebox.com/course/preview/active-directory-bloodhound/bloodhound--data-collection

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_bloodhound_collection.yml