Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

MS Scripting Process Loading Ldap Module

The following analytic detects the execution of MS scripting processes (wscript.exe or cscript.exe) loading LDAP-related modules (Wldap32.dll, adsldp.dll, adsldpc.dll). It leverages Sysmon EventCode 7 to identify these specific DLL loads. This activity is significant as it may indicate an attempt to query LDAP for host information, a behavior observed in FIN7 implants. If confirmed malicious, this could allow attackers to gather detailed Active Directory information, potentially leading to further exploitation or data exfiltration.

ATT&CK coverage

Outside the enterprise matrix

T1059.007JavaScript 64 detections cover this technique

Detection requirements

Log source category: sysmon_eventid_7

What the source says

What fires this without an attack behind it

automation scripting language may used by network operator to do ldap query.

References

Tagged by the source as

FIN7EndpointendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.