Windows: Detect esentutl.exe Copying Sensitive Credential Files via VSS
Alerts on esentutl.exe VSS usage and command lines referencing SAM/SECURITY/SYSTEM or ntds.dit copy targets.
- Product
- windows
- Category
- process_creation
- Author
- Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-22
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where esentutl.exe is invoked in a way consistent with copying sensitive system or credential-related files. It also matches command lines that include VSS-related parameters and targets well-known registry hive and directory/service database paths that commonly hold credential material. Attackers may use this technique to stage or exfiltrate credential data for offline extraction, so the rule relies on Windows process creation telemetry including the executable name and command line content.
Reporting behind it
- room362.comhttps://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/
- slideshare.nethttps://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
- dfironthemountain.wordpress.comhttps://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/
- github.comhttps://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Esentutl.yml
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_esentutl_sensitive_file_copy.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect esentutl.exe Copying Sensitive Credential Files via VSS"
id: 2f2185ab-e1fa-4d73-b83f-444bb6e8db2a
status: test
description: This rule flags process creation events where esentutl.exe is invoked in a way consistent with copying sensitive system or credential-related files. It also matches command lines that include VSS-related parameters and targets well-known registry hive and directory/service database paths that commonly hold credential material. Attackers may use this technique to stage or exfiltrate credential data for offline extraction, so the rule relies on Windows process creation telemetry including the executable name and command line content.
references:
- https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/
- https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
- https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/
- https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Esentutl.yml
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_esentutl_sensitive_file_copy.yml
author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2019-10-22
modified: 2024-06-04
tags:
- attack.credential-access
- attack.t1003.002
- attack.t1003.003
- car.2013-07-001
- attack.s0404
logsource:
category: process_creation
product: windows
detection:
selection_esent_img:
- Image|endswith: \esentutl.exe
- OriginalFileName: \esentutl.exe
selection_esent_cli:
CommandLine|contains|windash:
- vss
- " /m "
- " /y "
selection_susp_paths:
CommandLine|contains:
- \config\RegBack\sam
- \config\RegBack\security
- \config\RegBack\system
- \config\sam
- \config\security
- "\\config\\system "
- \repair\sam
- \repair\security
- \repair\system
- \windows\ntds\ntds.dit
condition: all of selection_esent_* or selection_susp_paths
falsepositives:
- Copying sensitive files for legitimate use (eg. backup) or forensic investigation by legitimate incident responder or forensic investigator.
level: high
license: DRL-1.1
related:
- id: e7be6119-fc37-43f0-ad4f-1f3f99be2f9f
type: derived