Detection proposal: Sysinternals ADExplorer Active Directory snapshots
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 55/100
- Issue type
- Feature
- Clarity
- Clearly specified
- Activity status
- Active
- Domain
- security
Research direction
Start with the existing Active Directory Discovery story and related issues #4382 and #4383 to understand how detections are organized. Then inspect the detection content and run contentctl-ng build. Done means both proposed ADExplorer detections build successfully and cover the execution and snapshot behaviors described, including excluding the SchCache schema cache.
Written by the indexing model from the issue text.
Description
Gap. Scattered Spider, LAPSUS$ and ransomware affiliates use Sysinternals ADExplorer to take a full offline snapshot of Active Directory, then convert it for BloodHound or mine it for targets. security_content has no analytic that references ADExplorer (no name, no OriginalFileName, no snapshot file). Sigma has rules keyed on the image name with a -snapshot argument, or on an ADExplorer image writing a .dat file. In my lab each of those caught only 2 of 4 real snapshots: a renamed copy, a GUI menu snapshot and a non-.dat extension each evade at least one of them.
Proposal.
- Windows Sysinternals ADExplorer Execution (Anomaly, Endpoint.Processes): process name or OriginalFileName
AdExp. Triage fields: renamed andsnapshot_cli. - Windows AD Snapshot Created By ADExplorer (TTP, Sysmon EID 1 + 11): a process with OriginalFileName
AdExpthat writes any file other than the ADSI schema cache (SchCache\*.sch, written on every connection). This catches renamed copies, GUI snapshots and any extension.
Both would go under the existing Active Directory Discovery story (T1087.002, T1069.002).
Evidence. Windows Server 2025 lab DC with Sysmon 15.22 and 6 cases (4 snapshots, 1 GUI launch without a snapshot, 1 PowerShell LDAP negative). Results: Execution 5/5, Snapshot 4/4, no SchCache false positive. contentctl-ng build passes. Related: #4382, #4383 and the dMSA proposal.
- Dominant language
- Python
- Stars
- 1.7k
- Forks
- 507
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 35
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from splunk/security_content
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 78/100
splunk/security_content#4418 ·
Maintainers usually reply within 1 day
-
[BUG] Windows New EventLog ChannelAccess Registry Value Set: second path has single backslashesOpenbug
Difficulty 1/5 1-3 hours Newbie friendliness 78/100
splunk/security_content#4417 ·
Maintainers usually reply within 1 day
-
[BUG]Linux Change File Owner To Root: detection bypass using "chown root: <file>"Possibly taken @thegreatmhn claimed this 1 day ago. Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
splunk/security_content#4413 · 4 comments ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
splunk/security_content#4401 ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
splunk/security_content#4400 ·
Maintainers usually reply within 1 day
All issues in splunk/security_content
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
deepchem/deepchem#5289 · 1 comment ·
Maintainers usually reply within 2 days
-
Difficulty 1/5 Under an hour Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 60/100
UKGovernmentBEIS/inspect_evals#2892 · 1 comment ·
Maintainers usually reply within 1 day
-
Versioning docs: say that no output from the 0.46 warning check means nothing is affectedPossibly taken @grelinfo claimed this today. Opendocumentation priority:low size:S
Difficulty 1/5 Under an hour Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
alphacrack/readme2demo#293 ·