Active Directory Structure Export Via Csvde.EXE

Title: Active Directory Structure Export Via Csvde.EXE
Status: test
Description:Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.
References:
  -https://www.cybereason.com/blog/research/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
  -https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
  -https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit
  -https://redcanary.com/blog/msix-installers/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-14
modified:None
Tags:

• -'attack.exfiltration'
• -'attack.discovery'
• -'attack.t1087.002'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\csvde.exe' OriginalFileName:'csvde.exe'   selection_remote:
    CommandLine|contains: ' -f'
  filter_import:
    CommandLine|contains: ' -i'
  condition:all of selection_* and not 1 of filter_*
Falsepositives:
  -Unknown
Level: medium