Windows: Detect ESENT New Database Created with ntds.dit Written to Suspicious Path
Identifies ESENT EventID 325 where a new database containing ntds.dit is created in suspicious locations.
- Product
- windows
- Service
- application
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-14
- Updated
- 2026-07-31
What it detects
This rule flags Windows application events where ESENT reports a new database being created and the event data contains "ntds.dit", indicating a potential ntdsutil-based dump of the Active Directory database to an unusual location. Such activity is important because exporting ntds.dit can enable credential and directory data theft. It relies on Windows application telemetry from ESENT, specifically events with EventID 325 and event data containing "ntds.dit" and a suspicious destination-like path segment.
Reporting behind it
- twitter.comhttps://twitter.com/mgreen27/status/1558223256704122882
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11)
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/esent/win_esent_ntdsutil_abuse_susp_location.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect ESENT New Database Created with ntds.dit Written to Suspicious Path"
id: 922e83f1-2391-4ad2-828e-a6b9147df53b
status: test
description: This rule flags Windows application events where ESENT reports a new database being created and the event data contains "ntds.dit", indicating a potential ntdsutil-based dump of the Active Directory database to an unusual location. Such activity is important because exporting ntds.dit can enable credential and directory data theft. It relies on Windows application telemetry from ESENT, specifically events with EventID 325 and event data containing "ntds.dit" and a suspicious destination-like path segment.
references:
- https://twitter.com/mgreen27/status/1558223256704122882
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11)
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/esent/win_esent_ntdsutil_abuse_susp_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-14
modified: 2023-10-23
tags:
- attack.execution
logsource:
product: windows
service: application
detection:
selection_root:
Provider_Name: ESENT
EventID: 325
Data|contains: ntds.dit
selection_paths:
Data|contains:
- :\ntds.dit
- \Appdata\
- \Desktop\
- \Downloads\
- \Perflogs\
- \Temp\
- \Users\Public\
condition: all of selection_*
falsepositives:
- Legitimate backup operation/creating shadow copies
level: medium
license: DRL-1.1
related:
- id: 94dc4390-6b7c-4784-8ffc-335334404650
type: derived