Sigma rule: ADSI-Cache File Creation By Uncommon Tool

Rule

Title

ADSI-Cache File Creation By Uncommon Tool

Status

test

Level

medium

Author

xknow @xknow_infosec, Tim Shelton

Date

2019-03-24

Modified

2023-10-18

File

rules/windows/file/file_event/file_event_win_adsi_cache_creation_by_uncommon_tool.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.

Log source

product

windows

category

file_event

Detection

selection:
    TargetFilename|contains: '\Local\Microsoft\Windows\SchCache\'
    TargetFilename|endswith: '.sch'
filter_main_generic:
    - Image|endswith:
          - ':\Program Files\Cylance\Desktop\CylanceSvc.exe'
          - ':\Windows\CCM\CcmExec.exe'
          - ':\windows\system32\dllhost.exe'
          - ':\Windows\system32\dsac.exe'
          - ':\Windows\system32\efsui.exe'
          - ':\windows\system32\mmc.exe'
          - ':\windows\system32\svchost.exe'
          - ':\Windows\System32\wbem\WmiPrvSE.exe'
          - ':\windows\system32\WindowsPowerShell\v1.0\powershell.exe'
    - Image|contains:
          - ':\Windows\ccmsetup\autoupgrade\ccmsetup' # C:\Windows\ccmsetup\autoupgrade\ccmsetup.TMC00002.40.exe
          - ':\Program Files\SentinelOne\Sentinel Agent' # C:\Program Files\SentinelOne\Sentinel Agent 21.7.7.40005\SentinelAgent.exe
filter_main_office:
    Image|contains|all:
        - ':\Program Files\'
        - '\Microsoft Office'
    Image|endswith: '\OUTLOOK.EXE'
filter_optional_ldapwhoami:
    Image|endswith: '\LANDesk\LDCLient\ldapwhoami.exe'
filter_optional_citrix:
    # Example:
    #   TargetFilename=C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\SchCache\REDACTED.com.sch
    Image|endswith: ':\Program Files\Citrix\Receiver StoreFront\Services\DefaultDomainServices\Citrix.DeliveryServices.DomainServices.ServiceHost.exe'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Other legimate tools, which do ADSI (LDAP) operations, e.g. any remoting activity by MMC, Powershell, Windows etc.

Tags

• attack.t1001.003
• attack.command-and-control

MITRE ATT&CK ids this rule names

• T1001.003

References

• https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961
• https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/
• https://github.com/fox-it/LDAPFragger

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_adsi_cache_creation_by_uncommon_tool.yml