SOAPHound Execution for Active Directory Data Collection
Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information. The rule specifically looks for command-line arguments related to building caches, dumping bloodhound data, certificate dumping, and DNS dumping, combined with arguments for cache filenames or output directories.
Sigma
