name: Detect SharpHound Command-Line Arguments
id: a0bdd2f6-c2ff-11eb-b918-acde48001122
version: 1
date: '2021-06-01'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies common command-line arguments used
  by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS,
  function names may be modified, but these changes are dependent upon the operator.
  In most instances the defaults are used. This analytic works to identify the common
  command-line attributes used. It does not cover the entirety of every argument in
  order to avoid false positives.
data_source:
- Sysmon Event ID 1
search:
  selection1:
    CommandLine:
    - '*-collectionMethod*'
    - '*invoke-bloodhound*'
  condition: selection1
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node.
known_false_positives: False positives should be limited as the arguments used are
  specific to SharpHound. Filter as needed or add more command-line arguments as needed.
references:
- https://attack.mitre.org/software/S0521/
- https://thedfirreport.com/?s=bloodhound
- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
- https://github.com/BloodHoundAD/SharpHound3
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
tags:
  analytic_story:
  - Discovery Techniques
  - Ransomware
  asset_type: Endpoint
  confidence: 80
  impact: 30
  message: Possible SharpHound command-Line arguments identified on $dest$
  mitre_attack_id:
  - T1087.002
  - T1069.001
  - T1482
  - T1087.001
  - T1087
  - T1069.002
  - T1069
  observable:
  - name: dest
    type: Endpoint
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 24
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog