HackTool - SharpLDAPmonitor Execution
Detects the execution of SharpLDAPmonitor, a tool used to monitor the creation, deletion, and changes to LDAP objects. This rule triggers on either the image name 'SharpLDAPmonitor.exe' or its original filename, combined with command-line arguments indicating user, password, and domain controller IP, which are typical for LDAP monitoring activities.
Sigma
