Detection of SharpHound Active Directory Enumeration
Attackers utilize the SharpHound tool for automated Active Directory enumeration to map network structures and identify targets for lateral movement and privilege escalation.
SharpHound is a widely used collection utility for the BloodHound project, designed to perform comprehensive Active Directory (AD) enumeration. By querying AD objects, groups, and permissions, the tool assists attackers in identifying attack paths, discovering high-value accounts, and mapping domain trust relationships. This activity often serves as a reconnaissance phase preceding lateral movement, privilege escalation, or ransomware deployment, such as that observed in BlackSuit Ransomware campaigns. Detection is focused on identifying command-line arguments unique to the execution of the SharpHound binary or PowerShell script, specifically flagging indicators of the collection phase.
Impact
Successful execution of SharpHound provides attackers with detailed visibility into domain infrastructure. This reconnaissance enables efficient targeting of domain controllers, administrative users, and sensitive file shares, significantly increasing the risk of data exfiltration and domain-wide compromise.
Recommendation
Deploy the provided Sigma rule to monitor for suspicious process execution strings indicative of Active Directory enumeration. Ensure that Sysmon Event ID 1 or Windows Event ID 4688 is ingested with full command-line arguments to maintain visibility.
Immediate actions
Deploy Sigma detection rule to SIEM/EDR.
Threat Hunt
Search historical process logs for SharpHound command-line arguments.
Data: Process command line
Detection coverage 1
Detect SharpHound Command-Line Arguments
mediumDetects the execution of SharpHound using known command-line arguments associated with AD enumeration, such as -collectionMethod and invoke-bloodhound.
Detection queries are available on the platform. Get full rules →