Windows: Detect ESENT New Database Created with ntds.dit Written to Suspicious Path

Identifies ESENT EventID 325 where a new database containing ntds.dit is created in suspicious locations.

FreeReviewedSigma · Medium · v2
Product
windows
Service
application
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-08-14
Updated
2026-07-31
title: "Windows: Detect ESENT New Database Created with ntds.dit Written to Suspicious Path"
id: 922e83f1-2391-4ad2-828e-a6b9147df53b
status: test
description: This rule flags Windows application events where ESENT reports a new database being created and the event data contains "ntds.dit", indicating a potential ntdsutil-based dump of the Active Directory database to an unusual location. Such activity is important because exporting ntds.dit can enable credential and directory data theft. It relies on Windows application telemetry from ESENT, specifically events with EventID 325 and event data containing "ntds.dit" and a suspicious destination-like path segment.
references:
  - https://twitter.com/mgreen27/status/1558223256704122882
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/esent/win_esent_ntdsutil_abuse_susp_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-14
modified: 2023-10-23
tags:
  - attack.execution
logsource:
  product: windows
  service: application
detection:
  selection_root:
    Provider_Name: ESENT
    EventID: 325
    Data|contains: ntds.dit
  selection_paths:
    Data|contains:
      - :\ntds.dit
      - \Appdata\
      - \Desktop\
      - \Downloads\
      - \Perflogs\
      - \Temp\
      - \Users\Public\
  condition: all of selection_*
falsepositives:
  - Legitimate backup operation/creating shadow copies
level: medium
license: DRL-1.1
related:
  - id: 94dc4390-6b7c-4784-8ffc-335334404650
    type: derived