blue-team-tools/rules/windows/process_creation/proc_creation_win_hack_bloodhound.yml

title: Bloodhound and Sharphound Hack Tool
id: f376c8a7-a2d0-4ddc-aa0c-16c17236d962
status: test
description: Detects command line parameters used by Bloodhound and Sharphound hack tools
author: Florian Roth
references:
  - https://github.com/BloodHoundAD/BloodHound
  - https://github.com/BloodHoundAD/SharpHound
date: 2019/12/20
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    Image|contains:
      - '\Bloodhound.exe'
      - '\SharpHound.exe'
  selection2:
    CommandLine|contains:
      - ' -CollectionMethod All '
      - '.exe -c All -d '
      - 'Invoke-Bloodhound'
      - 'Get-BloodHoundData'
  selection3:
    CommandLine|contains|all:
      - ' -JsonFolder '
      - ' -ZipFileName '
  selection4:
    CommandLine|contains|all:
      - ' DCOnly '
      - ' --NoSaveCache '
  condition: 1 of selection*
falsepositives:
  - Other programs that use these command line option and accepts an 'All' parameter
level: high
tags:
  - attack.discovery
  - attack.t1087.001
  - attack.t1087.002
  - attack.t1482
  - attack.t1069.001
  - attack.t1069.002
  - attack.execution
  - attack.t1059.001