search

BloodHoundAD / SharpHound2

The Old BloodHound C# Ingestor (Deprecated)
509 stars 113 forks source link

Feature request: Make host-unique randomized cache file names #48

Closed mgeeky closed 5 years ago

mgeeky commented 5 years ago

Hi,

According to my field experience - default artifact's name raises an immediate alert from various EDR/HIPS agents, like FireEye HX. I'd like to propose a way to generate host-dependent unique name, that would be for instance generated from tuple of ($Env:Hostname, $Env:Username, $Env:Userdnsdomain). Such a tuple could then be fed to some kind of hashing/mangling function that would create randomized cache file effectively bypassing simple artifact-based HIPS rules.

CacheFile - Filename for the Sharphound cache. (Default: BloodHound.bin)
mgeeky commented 5 years ago

I've addressed my own issue in PR#50.

rvazarkar commented 5 years ago

I addressed this issue with my own commit https://github.com/BloodHoundAD/SharpHound/commit/e763032fa714d7291ed86e39f9e38bf0f405b293

The machine specific cache file name is generated using the machine sid of the local machine, so changing hostnames wont mess it up. It also renames the old BloodHound.bin on run to the new format so cache files aren't lost.

rvazarkar commented 5 years ago

Thanks for the suggestion!