Windows: Execution of ntdsutil.exe for NTDS database operations

Flags execution of ntdsutil.exe, a utility that can be used to manipulate the NTDS database (NTDS.DIT).

FreeUnreviewedSigmamediumv1

windows-execution-of-ntdsutil-exe-for-ntds-database-operations-2afafd61

title: "Windows: Execution of ntdsutil.exe for NTDS database operations"
id: 035921c7-cfde-498e-959c-f4f0aee9329c
status: test
description: This rule identifies process creation events where ntdsutil.exe is executed on a Windows host. Because ntdsutil.exe is used to manage and interact with the NTDS database (NTDS.DIT), attackers may leverage it as part of credential access or directory-related abuse. The detection relies on Windows process creation telemetry by matching the executed binary path ending with \ntdsutil.exe.
references:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/ntdsutil.htm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ntdsutil_usage.yml
author: Thomas Patzke, Huntrule Team
date: 2019-01-16
modified: 2022-03-11
tags:
  - attack.credential-access
  - attack.t1003.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \ntdsutil.exe
  condition: selection
falsepositives:
  - NTDS maintenance
level: medium
license: DRL-1.1
related:
  - id: 2afafd61-6aae-4df4-baed-139fa1f4c345
    type: derived

What it detects

This rule identifies process creation events where ntdsutil.exe is executed on a Windows host. Because ntdsutil.exe is used to manage and interact with the NTDS database (NTDS.DIT), attackers may leverage it as part of credential access or directory-related abuse. The detection relies on Windows process creation telemetry by matching the executed binary path ending with \ntdsutil.exe.

Known false positives

NTDS maintenance

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.