Suspicious Ntdsutil Misuse (via application)

title: Suspicious Ntdsutil Misuse (via application)
id: f970330a-c859-50f6-9ea2-b11f45d4a6bd
status: stable
description: This rule detects potential misuse of ntdsutil to dump ntds.dit database
references:
    - https://attack.mitre.org/techniques/T1003/003/
    - https://twitter.com/mgreen27/status/1558223256704122882
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11)
author: Huntrule Team
date: 2026-03-10
tags:
    - attack.credential-access
    - attack.t1003.003
logsource:
    product: windows
    service: application
detection:
    selection:
        Provider_Name: 'ESENT'
        EventID:
            - 216
            - 325
            - 326
            - 327
        Data|contains: 'ntds.dit'
    condition: selection
falsepositives:
    - Unknown
level: medium