Windows: Copying Sensitive Credential Files via esentutl vss Command Lines

Alerts on esentutl.exe VSS usage and command lines referencing SAM/SECURITY/SYSTEM or ntds.dit copy targets.

FreeUnreviewedSigmahighv1

windows-copying-sensitive-credential-files-via-esentutl-vss-command-lines-e7be6119

title: "Windows: Copying Sensitive Credential Files via esentutl vss Command Lines"
id: 2f2185ab-e1fa-4d73-b83f-444bb6e8db2a
status: test
description: This rule flags Windows process creation events where esentutl.exe is invoked with VSS-related command-line arguments and/or references paths to well-known sensitive credential files (e.g., SAM, SECURITY, SYSTEM, and ntds.dit). Such activity matters because attackers can use the VSS/backup mechanism to obtain offline copies of credential stores for later extraction. The detection relies on process creation telemetry, specifically process image/original file name matching and command-line/path substring patterns.
references:
  - https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/
  - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Esentutl.yml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_esentutl_sensitive_file_copy.yml
author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2019-10-22
modified: 2024-06-04
tags:
  - attack.credential-access
  - attack.t1003.002
  - attack.t1003.003
  - car.2013-07-001
  - attack.s0404
logsource:
  category: process_creation
  product: windows
detection:
  selection_esent_img:
    - Image|endswith: \esentutl.exe
    - OriginalFileName: \esentutl.exe
  selection_esent_cli:
    CommandLine|contains|windash:
      - vss
      - " /m "
      - " /y "
  selection_susp_paths:
    CommandLine|contains:
      - \config\RegBack\sam
      - \config\RegBack\security
      - \config\RegBack\system
      - \config\sam
      - \config\security
      - "\\config\\system "
      - \repair\sam
      - \repair\security
      - \repair\system
      - \windows\ntds\ntds.dit
  condition: all of selection_esent_* or selection_susp_paths
falsepositives:
  - Copying sensitive files for legitimate use (eg. backup) or forensic investigation by legitimate incident responder or forensic investigator.
level: high
license: DRL-1.1
related:
  - id: e7be6119-fc37-43f0-ad4f-1f3f99be2f9f
    type: derived

What it detects

This rule flags Windows process creation events where esentutl.exe is invoked with VSS-related command-line arguments and/or references paths to well-known sensitive credential files (e.g., SAM, SECURITY, SYSTEM, and ntds.dit). Such activity matters because attackers can use the VSS/backup mechanism to obtain offline copies of credential stores for later extraction. The detection relies on process creation telemetry, specifically process image/original file name matching and command-line/path substring patterns.

Known false positives

Copying sensitive files for legitimate use (eg. backup) or forensic investigation by legitimate incident responder or forensic investigator.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.