huntrule

Windows: Detect esentutl.exe Copying Sensitive Credential Files via VSS

Alerts on esentutl.exe VSS usage and command lines referencing SAM/SECURITY/SYSTEM or ntds.dit copy targets.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community (SigmaHQ), DRL 1.1
Published
2019-10-22
Updated
2026-07-31
AnalysisDetection
title: "Windows: Detect esentutl.exe Copying Sensitive Credential Files via VSS"
id: 2f2185ab-e1fa-4d73-b83f-444bb6e8db2a
status: test
description: This rule flags process creation events where esentutl.exe is invoked in a way consistent with copying sensitive system or credential-related files. It also matches command lines that include VSS-related parameters and targets well-known registry hive and directory/service database paths that commonly hold credential material. Attackers may use this technique to stage or exfiltrate credential data for offline extraction, so the rule relies on Windows process creation telemetry including the executable name and command line content.
references:
  - https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/
  - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Esentutl.yml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_esentutl_sensitive_file_copy.yml
author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2019-10-22
modified: 2024-06-04
tags:
  - attack.credential-access
  - attack.t1003.002
  - attack.t1003.003
  - car.2013-07-001
  - attack.s0404
logsource:
  category: process_creation
  product: windows
detection:
  selection_esent_img:
    - Image|endswith: \esentutl.exe
    - OriginalFileName: \esentutl.exe
  selection_esent_cli:
    CommandLine|contains|windash:
      - vss
      - " /m "
      - " /y "
  selection_susp_paths:
    CommandLine|contains:
      - \config\RegBack\sam
      - \config\RegBack\security
      - \config\RegBack\system
      - \config\sam
      - \config\security
      - "\\config\\system "
      - \repair\sam
      - \repair\security
      - \repair\system
      - \windows\ntds\ntds.dit
  condition: all of selection_esent_* or selection_susp_paths
falsepositives:
  - Copying sensitive files for legitimate use (eg. backup) or forensic investigation by legitimate incident responder or forensic investigator.
level: high
license: DRL-1.1
related:
  - id: e7be6119-fc37-43f0-ad4f-1f3f99be2f9f
    type: derived