Dump Ntds.dit To Suspicious Location (via application)

title: Dump Ntds.dit To Suspicious Location (via application)
id: 3eab86ce-748d-5099-8d97-677e28e6494f
status: stable
description: This rule detects potential misuse of ntdsutil to dump ntds.dit database to an anomalous location
references:
    - https://twitter.com/mgreen27/status/1558223256704122882
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11)
author: Huntrule Team
date: 2026-01-09
tags:
    - attack.execution
    - attack.credential-access
    - attack.t1003.003
logsource:
    product: windows
    service: application
detection:
    selection_root:
        Provider_Name: 'ESENT'
        EventID: 325
        Data|contains: 'ntds.dit'
    selection_paths:
        Data|contains:
            - ':\ntds.dit'
            - '\Appdata\'
            - '\Desktop\'
            - '\Downloads\'
            - '\Perflogs\'
            - '\Temp\'
            - '\Users\Public\'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium