Windows File Events: NTDS.DIT Created by Suspicious or Rare Process
Alerts on creation of ntds.dit on Windows when the creator process image/path is uncommon or located in suspicious directories.
- Product
- windows
- Category
- file_event
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-01-11
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags creation of a file ending with \ntds.dit, the Active Directory database, when the creating process is uncommon or originates from commonly abused directories. Attackers may target NTDS.DIT to obtain credential material by forcing it to be written or manipulated outside normal system workflows. The detection relies on Windows file event telemetry that includes the target filename and the process image path for the write/creation event.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows File Events: NTDS.DIT Created by Suspicious or Rare Process"
id: eda80f24-dd84-4205-9cf4-94f395723dc5
related:
- id: 4e7050dd-e548-483f-b7d6-527ab4fa784d
type: similar
- id: 11b1ed55-154d-4e82-8ad7-83739298f720
type: derived
status: test
description: This rule flags creation of a file ending with \ntds.dit, the Active Directory database, when the creating process is uncommon or originates from commonly abused directories. Attackers may target NTDS.DIT to obtain credential material by forcing it to be written or manipulated outside normal system workflows. The detection relies on Windows file event telemetry that includes the target filename and the process image path for the write/creation event.
references:
- https://stealthbits.com/blog/extracting-password-hashes-from-the-ntds-dit-file/
- https://adsecurity.org/?p=2398
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_ntds_dit_uncommon_process.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-01-11
modified: 2022-07-14
tags:
- attack.credential-access
- attack.t1003.002
- attack.t1003.003
logsource:
product: windows
category: file_event
detection:
selection_ntds:
TargetFilename|endswith: \ntds.dit
selection_process_img:
Image|endswith:
- \cmd.exe
- \cscript.exe
- \mshta.exe
- \powershell.exe
- \pwsh.exe
- \regsvr32.exe
- \rundll32.exe
- \wscript.exe
- \wsl.exe
- \wt.exe
selection_process_paths:
Image|contains:
- \AppData\
- \Temp\
- \Public\
- \PerfLogs\
condition: selection_ntds and 1 of selection_process_*
falsepositives:
- Unknown
level: high
license: DRL-1.1