Windows: Execution of ntdsutil.exe for NTDS database operations
Flags execution of ntdsutil.exe, a utility that can be used to manipulate the NTDS database (NTDS.DIT).
- Product
- windows
- Category
- process_creation
- Author
- Thomas Patzke (SigmaHQ), DRL 1.1
- Published
- 2019-01-16
- Updated
- 2026-07-30
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation events where ntdsutil.exe is executed on a Windows host. Because ntdsutil.exe is used to manage and interact with the NTDS database (NTDS.DIT), attackers may leverage it as part of credential access or directory-related abuse. The detection relies on Windows process creation telemetry by matching the executed binary path ending with \ntdsutil.exe.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Execution of ntdsutil.exe for NTDS database operations"
id: 035921c7-cfde-498e-959c-f4f0aee9329c
status: test
description: This rule identifies process creation events where ntdsutil.exe is executed on a Windows host. Because ntdsutil.exe is used to manage and interact with the NTDS database (NTDS.DIT), attackers may leverage it as part of credential access or directory-related abuse. The detection relies on Windows process creation telemetry by matching the executed binary path ending with \ntdsutil.exe.
references:
- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/ntdsutil.htm
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ntdsutil_usage.yml
author: Thomas Patzke, Huntrule Team
date: 2019-01-16
modified: 2022-03-11
tags:
- attack.credential-access
- attack.t1003.003
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \ntdsutil.exe
condition: selection
falsepositives:
- NTDS maintenance
level: medium
license: DRL-1.1
related:
- id: 2afafd61-6aae-4df4-baed-139fa1f4c345
type: derived