BloodHound Collection Files
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects default file names outputted by the BloodHound collection tool SharpHound.
Severity
Trouble
Rule Requirement
Criteria
Action1:
actionname = "File Created or Modified" AND (( OBJECTNAME contains "BloodHound.zip,_computers.json,_containers.json,_gpos.json,_groups.json,_ous.json,_users.json" OR FILENAME contains "BloodHound.zip,_computers.json,_containers.json,_gpos.json,_groups.json,_ous.json,_users.json" ) AND PROCESSNAME notendswith "\svchost.exe" AND ( OBJECTNAME notcontains "Program Files\WindowsApps\Microsoft" OR FILENAME notcontains "Program Files\WindowsApps\Microsoft" ) AND ( OBJECTNAME notendswith "\pocket_containers.json" OR FILENAME notendswith "\pocket_containers.json" ))
select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.OBJECTNAME,Action1.FILENAME,Action1.PROCESSNAME,Action1.FILETYPE,Action1.ACCESSLIST
Detection
Execution Mode
realtime
Log Sources
Windows
Author
@C.J. May
