Windows: Detect ESENT New Database Creation for ntds.dit in Suspicious Paths

Identifies ESENT EventID 325 where a new database containing ntds.dit is created in suspicious locations.

FreeUnreviewedSigmamediumv1

windows-detect-esent-new-database-creation-for-ntds-dit-in-suspicious-paths-94dc4390

title: "Windows: Detect ESENT New Database Creation for ntds.dit in Suspicious Paths"
id: 922e83f1-2391-4ad2-828e-a6b9147df53b
status: test
description: This rule flags Windows application events where ESENT creates a new database containing the string ntds.dit, and the database path is located in a set of commonly suspicious locations (or directly references ':/\ntds.dit'). This behavior can indicate attempts to extract the Active Directory database (ntds.dit) using ntdsutil-style workflows, which attackers abuse for credential theft. It relies on Windows Application telemetry reporting ESENT Provider_Name, EventID 325, and event data fields containing ntds.dit and the relevant path substrings.
references:
  - https://twitter.com/mgreen27/status/1558223256704122882
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/esent/win_esent_ntdsutil_abuse_susp_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-14
modified: 2023-10-23
tags:
  - attack.execution
logsource:
  product: windows
  service: application
detection:
  selection_root:
    Provider_Name: ESENT
    EventID: 325
    Data|contains: ntds.dit
  selection_paths:
    Data|contains:
      - :\ntds.dit
      - \Appdata\
      - \Desktop\
      - \Downloads\
      - \Perflogs\
      - \Temp\
      - \Users\Public\
  condition: all of selection_*
falsepositives:
  - Legitimate backup operation/creating shadow copies
level: medium
license: DRL-1.1
related:
  - id: 94dc4390-6b7c-4784-8ffc-335334404650
    type: derived

What it detects

This rule flags Windows application events where ESENT creates a new database containing the string ntds.dit, and the database path is located in a set of commonly suspicious locations (or directly references ':/\ntds.dit'). This behavior can indicate attempts to extract the Active Directory database (ntds.dit) using ntdsutil-style workflows, which attackers abuse for credential theft. It relies on Windows Application telemetry reporting ESENT Provider_Name, EventID 325, and event data fields containing ntds.dit and the relevant path substrings.

Known false positives

Legitimate backup operation/creating shadow copies

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.