Suspicious Esentutl Gather Credentials (via process_creation)

title: Suspicious Esentutl Gather Credentials (via process_creation)
id: 10e017d5-66d0-59fa-896c-301c6c605185
status: stable
description: This rule detects conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.
references:
    - https://attack.mitre.org/techniques/T1003/003/
    - https://attack.mitre.org/techniques/T1003/
    - https://twitter.com/vxunderground/status/1423336151860002816
    - https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/
author: Huntrule Team
date: 2026-07-06
tags:
    - attack.credential-access
    - attack.t1003
    - attack.t1003.003
    - attack.s0404
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'esentutl'
            - ' /p'
    condition: selection
falsepositives:
    - Unknown
level: medium