name: MS Scripting Process Loading Ldap Module
id: 0b0c40dc-14a6-11ec-b267-acde48001122
version: 2
date: '2024-05-19'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the execution of MS scripting processes
  (wscript.exe or cscript.exe) loading LDAP-related modules (Wldap32.dll, adsldp.dll,
  adsldpc.dll). It leverages Sysmon EventCode 7 to identify these specific DLL loads.
  This activity is significant as it may indicate an attempt to query LDAP for host
  information, a behavior observed in FIN7 implants. If confirmed malicious, this
  could allow attackers to gather detailed Active Directory information, potentially
  leading to further exploitation or data exfiltration.
data_source:
- Sysmon EventID 7
search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded
  IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") | stats min(_time) as firstTime
  max(_time) as lastTime count by Image EventCode process_name ProcessId ProcessGuid
  Computer ImageLoaded | rename Computer as dest | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `ms_scripting_process_loading_ldap_module_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
known_false_positives: automation scripting language may used by network operator
  to do ldap query.
references:
- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation
- https://attack.mitre.org/groups/G0046/
tags:
  analytic_story:
  - FIN7
  asset_type: Endpoint
  confidence: 30
  impact: 30
  message: $process_name$ loading ldap modules $ImageLoaded$ in $dest$
  mitre_attack_id:
  - T1059
  - T1059.007
  observable:
  - name: dest
    type: Endpoint
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Image
  - EventCode
  - process_name
  - ProcessId
  - ProcessGuid
  - dest
  - ImageLoaded
  risk_score: 9
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: 
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_js_2/sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog