ldifde.exe

NT5DS file version info (xCyclopedia)

LOLBAS Download 3 Sigma rules name it 2 ATT&CK techniques 1 documented command 2 known copies with hashes

How ldifde.exe is abused

documented by LOLBAS

Download T1105 Ingress Tool Transfer

-i

-f

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for ldifde.exe.

1 documented command

from LOLBAS, each read by the identifier

Download T1105 Ingress Tool Transfer Administrator privileges

Import specified .ldf file into LDAP. If the file contains http-based attrval-spec such as thumbnailPhoto:< http://example.org/somefile.txt, the file will be downloaded into IE temp folder.

Ldifde -i -f {PATH:.ldf}

Identify

Trips 1 Sigma rule: mediumImport LDAP Data Interchange Format File Via Ldifde.EXE by @gott_cyber

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for ldifde.exe, by Grzegorz Tworek, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for ldifde.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumActive Directory Structure Export Via Ldifde.EXENasreddine Bencherchali (Nextron Systems)

mediumImport LDAP Data Interchange Format File Via Ldifde.EXE@gott_cyber

highWebshell Hacking Activity PatternsFlorian Roth (Nextron Systems)

T1105Ingress Tool Transfer

T1218System Binary Proxy Execution

Is it the real ldifde.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionNT5DS

2 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ldifde.exe · signed by Microsoft Windows

355a746e33b0df2f834fdef913ddcfdbd83f59a17ffd3a9f2afa48eee7be7e71

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\ldifde.exe · signed by Microsoft Windows

5ad7a0cef6122ea7ef485f75b75e4ec758882f43b5ec570e644690ecc80ae5e4

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.