splApache-2.0from splunk/security_content

SchCache Change By App Connect And Create ADSI Object

The following analytic detects an application attempting to connect and create an ADSI object to perform an LDAP query. It leverages Sysmon EventCode 11 to identify changes in the Active Directory Schema cache files located in %LOCALAPPDATA%\Microsoft\Windows\SchCache or %systemroot%\SchCache. This activity is significant as it can indicate the presence of suspicious applications, such as ransomware, using ADSI object APIs for LDAP queries. If confirmed malicious, this behavior could allow attackers to gather sensitive directory information, potentially leading to further exploitation or lateral movement within the network.

Quality

FP risk

—

Forks

Views

Rule sourcedetections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml

`sysmon` EventCode=11 TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename
    = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe"))
| stats count min(_time)
    as firstTime max(_time) as lastTime by action dest file_name file_path process_guid
    process_id user_id vendor_product process_name
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `schcache_change_by_app_connect_and_create_adsi_object_filter`