Suspicious ntdsutil.exe Use for AD Snapshot Mount or Activation (Windows Process Creation)

Alerts on ntdsutil.exe command lines that include snapshot mount and activation/instance fragments, indicating potential AD snapshot manipulation.

FreeUnreviewedSigmamediumv1

suspicious-ntdsutil-exe-use-for-ad-snapshot-mount-or-activation-windows-process--a58353df

title: Suspicious ntdsutil.exe Use for AD Snapshot Mount or Activation (Windows Process Creation)
id: 473a3c52-e906-428a-8a58-a9d0a2aa15eb
related:
  - id: 2afafd61-6aae-4df4-baed-139fa1f4c345
    type: derived
  - id: a58353df-af43-4753-bad0-cd83ef35eef5
    type: derived
status: test
description: This rule flags execution of ntdsutil.exe when the command line includes indicators consistent with mounting an AD snapshot and activating an instance (e.g., snapshot-related usage plus activation/instance fragments). Attackers may use ntdsutil.exe to gain access to directory data by manipulating snapshots, making this command-line pattern a useful credential-access indicator. The detection relies on Windows process creation telemetry, matching the executable name/path and specific substrings within the process command line.
references:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731620(v=ws.11)
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ntdsutil_susp_usage.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-14
tags:
  - attack.credential-access
  - attack.t1003.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \ntdsutil.exe
    - OriginalFileName: ntdsutil.exe
  selection_cli:
    - CommandLine|contains|all:
        - snapshot
        - "mount "
    - CommandLine|contains|all:
        - ac
        - " i"
        - " ntds"
  condition: all of selection_*
falsepositives:
  - Legitimate usage to restore snapshots
  - Legitimate admin activity
level: medium
license: DRL-1.1

What it detects

This rule flags execution of ntdsutil.exe when the command line includes indicators consistent with mounting an AD snapshot and activating an instance (e.g., snapshot-related usage plus activation/instance fragments). Attackers may use ntdsutil.exe to gain access to directory data by manipulating snapshots, making this command-line pattern a useful credential-access indicator. The detection relies on Windows process creation telemetry, matching the executable name/path and specific substrings within the process command line.

Known false positives

Legitimate usage to restore snapshots
Legitimate admin activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.