cscli scenarios install sigmahq/proc_creation_win_hktl_bloodhound_sharphound1type: trigger2name: sigmahq/proc_creation_win_hktl_bloodhound_sharphound3description: |4 Detects command line parameters used by Bloodhound and Sharphound hack tools5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.Product contains 'SharpHound' || evt.Parsed.Description contains 'SharpHound' || evt.Parsed.Company contains 'SpecterOps' || evt.Parsed.Company contains 'evil corp' || evt.Parsed.Image contains '\\Bloodhound.exe' || evt.Parsed.Image contains '\\SharpHound.exe' || evt.Parsed.CommandLine contains ' -CollectionMethod All ' || evt.Parsed.CommandLine contains ' --CollectionMethods Session ' || evt.Parsed.CommandLine contains ' --Loop --Loopduration ' || evt.Parsed.CommandLine contains ' --PortScanTimeout ' || evt.Parsed.CommandLine contains '.exe -c All -d ' || evt.Parsed.CommandLine contains 'Invoke-Bloodhound' || evt.Parsed.CommandLine contains 'Get-BloodHoundData' || evt.Parsed.CommandLine contains ' -JsonFolder ' && evt.Parsed.CommandLine contains ' -ZipFileName ' || evt.Parsed.CommandLine contains ' DCOnly ' && evt.Parsed.CommandLine contains ' --NoSaveCache ')7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t1087.00115 - attack.t1087.00216 - attack.t148217 - attack.t1069.00118 - attack.t1069.00219 - attack.t1059.0012021 label: "HackTool - Bloodhound/Sharphound Execution"22 behavior : "windows:audit"23 remediation: false2425scope:26 type: ParentProcessId27 expression: evt.Parsed.ParentProcessId2829