Windows File Creation of ntds.dit by Uncommon or Suspicious Processes

Alerts on creation of ntds.dit on Windows when the creator process image/path is uncommon or located in suspicious directories.

FreeUnreviewedSigmahighv1

windows-file-creation-of-ntds-dit-by-uncommon-or-suspicious-processes-11b1ed55

title: Windows File Creation of ntds.dit by Uncommon or Suspicious Processes
id: eda80f24-dd84-4205-9cf4-94f395723dc5
related:
  - id: 4e7050dd-e548-483f-b7d6-527ab4fa784d
    type: similar
  - id: 11b1ed55-154d-4e82-8ad7-83739298f720
    type: derived
status: test
description: This rule flags file creation events where a file named ntds.dit (Active Directory database) is created. It highlights cases where the creating process is either in a set of uncommon/scripting living-off-the-land executables or originates from suspicious-looking paths such as AppData, Temp, Public, or PerfLogs. This matters because adversaries may attempt to access credential material by interacting with the NTDS database, and attackers often stage or trigger such activity from user-writable or transient directories. The detection relies on Windows file event telemetry capturing the target filename and the creating process image/path details.
references:
  - https://stealthbits.com/blog/extracting-password-hashes-from-the-ntds-dit-file/
  - https://adsecurity.org/?p=2398
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_ntds_dit_uncommon_process.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-01-11
modified: 2022-07-14
tags:
  - attack.credential-access
  - attack.t1003.002
  - attack.t1003.003
logsource:
  product: windows
  category: file_event
detection:
  selection_ntds:
    TargetFilename|endswith: \ntds.dit
  selection_process_img:
    Image|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \wscript.exe
      - \wsl.exe
      - \wt.exe
  selection_process_paths:
    Image|contains:
      - \AppData\
      - \Temp\
      - \Public\
      - \PerfLogs\
  condition: selection_ntds and 1 of selection_process_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags file creation events where a file named ntds.dit (Active Directory database) is created. It highlights cases where the creating process is either in a set of uncommon/scripting living-off-the-land executables or originates from suspicious-looking paths such as AppData, Temp, Public, or PerfLogs. This matters because adversaries may attempt to access credential material by interacting with the NTDS database, and attackers often stage or trigger such activity from user-writable or transient directories. The detection relies on Windows file event telemetry capturing the target filename and the creating process image/path details.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.