huntrule

Windows: Execution of ntdsutil.exe for NTDS database operations

Flags execution of ntdsutil.exe, a utility that can be used to manipulate the NTDS database (NTDS.DIT).

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Thomas Patzke (SigmaHQ), DRL 1.1
Published
2019-01-16
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies process creation events where ntdsutil.exe is executed on a Windows host. Because ntdsutil.exe is used to manage and interact with the NTDS database (NTDS.DIT), attackers may leverage it as part of credential access or directory-related abuse. The detection relies on Windows process creation telemetry by matching the executed binary path ending with \ntdsutil.exe.

Reporting behind it

Related detections9 linkedT1003.003 — drag to rearrange
Suspicious Active Directory Snapshot Creation via ntdsutil
Malicious NTDS Credential Dump via Ntdsutil IFM Snapshot (via process_creation)
Malicious NTDS Database Dump via ntdsutil
Malicious NTDS Extraction from Volume Shadow Copy by RA World
Malicious NTDS Extraction via ntdsutil IFM
Malicious NTDS.dit Access via Shadow Copy GLOBALROOT Path
Suspicious Shadow Copy Creation via WMIC (via process_creation)
Malicious NTDS Extraction via Ntdsutil IFM
Malicious NTDS.dit Credential Extraction via ntdsutil
Windows: Execution of ntdsutil.exe for NTDS database operations
Pivot detection · T1003.003 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.