Import LDAP Data Interchange Format File Via Ldifde.EXE

calendar Aug 12, 2024 · attack.command-and-control attack.defense-evasion attack.t1218 attack.t1105  ·
Share on: linkedin copy

Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.

Sigma rule (View on GitHub)

 1title: Import LDAP Data Interchange Format File Via Ldifde.EXE
 2id: 6f535e01-ca1f-40be-ab8d-45b19c0c8b7f
 3status: test
 4description: |
 5        Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.
 6references:
 7    - https://twitter.com/0gtweet/status/1564968845726580736
 8    - https://strontic.github.io/xcyclopedia/library/ldifde.exe-979DE101F5059CEC1D2C56967CA2BAC0.html
 9    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)
10author: '@gott_cyber'
11date: 2022-09-02
12modified: 2023-03-14
13tags:
14    - attack.command-and-control
15    - attack.defense-evasion
16    - attack.t1218
17    - attack.t1105
18logsource:
19    category: process_creation
20    product: windows
21detection:
22    selection_img:
23        - Image|endswith: '\ldifde.exe'
24        - OriginalFileName: 'ldifde.exe'
25    selection_cli:
26        CommandLine|contains|all:
27            - '-i'
28            - '-f'
29    condition: all of selection_*
30falsepositives:
31    - Since the content of the files are unknown, false positives are expected
32level: medium

References

  • x.com


    Read More

  • ldifde.exe | NT5DS

    What is ldifde.exe?


    Read More

  • Ldifde

    Ldifde Article 08/31/2016 Applies To: Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2003 with SP1, Windows 8 Creates, modifies, and deletes d...


    Read More

Related rules

to-top