Detection of SharpHound Active Directory Enumeration Tool

SharpHound is the data collector binary for the BloodHound project, frequently utilized by attackers during the post-exploitation reconnaissance phase to map complex Active Directory relationships. By querying domain controllers and other systems, SharpHound extracts information regarding group memberships, user permissions, and object dependencies. This data is then imported into BloodHound to visualize attack paths, such as shortest paths to Domain Admin. The binary is often executed on compromised endpoints to gather intelligence that informs subsequent lateral movement, privilege escalation, and domain dominance strategies. Detecting the presence of this specific binary via EDR process metadata provides high-fidelity signals for identifying active reconnaissance within a Windows environment.

Attack Chain

1. Attacker gains initial access to a workstation or server within the domain.
2. Attacker drops the SharpHound.exe binary onto the local disk.
3. Attacker executes SharpHound.exe with specific flags (e.g., --CollectionMethod All) to initiate domain discovery.
4. SharpHound performs LDAP queries against Domain Controllers to enumerate users, groups, and computers.
5. Tool performs recursive queries to map object ownership and access control lists (ACLs).
6. Captured data is exported to a JSON or CSV file by the binary.
7. Attacker exfiltrates the output file to their command-and-control infrastructure for analysis.
8. Attacker uses the analyzed data to compromise high-value targets or escalate privileges within the Active Directory environment.

Impact

Successful reconnaissance with SharpHound allows attackers to map internal network architecture and identify hidden privilege escalation paths. This often serves as a precursor to large-scale lateral movement, credential theft, and ransomware deployment. Because it identifies high-value targets, its presence is a strong indicator of an adversary actively planning to broaden their control over the domain.

Recommendation

Prioritize the identification and investigation of unauthorized SharpHound executions within the environment.

• Deploy the provided Sigma rule to monitor for process creation events matching the known binary attributes.
• Configure EDR solutions to log OriginalFileName and process_name fields in Sysmon Event ID 1 or Windows Event ID 4688.
• Hunt for historical executions by searching process telemetry for SharpHound.exe across the last 30 days to identify past discovery activity.
• Implement strict application whitelisting or Constrained Language Mode in PowerShell to limit the ability to execute unauthorized binaries and scripts.