Windows File Events: NTDS.DIT Created by Suspicious or Rare Process

title: "Windows File Events: NTDS.DIT Created by Suspicious or Rare Process"
id: eda80f24-dd84-4205-9cf4-94f395723dc5
related:
  - id: 4e7050dd-e548-483f-b7d6-527ab4fa784d
    type: similar
  - id: 11b1ed55-154d-4e82-8ad7-83739298f720
    type: derived
status: test
description: This rule flags creation of a file ending with \ntds.dit, the Active Directory database, when the creating process is uncommon or originates from commonly abused directories. Attackers may target NTDS.DIT to obtain credential material by forcing it to be written or manipulated outside normal system workflows. The detection relies on Windows file event telemetry that includes the target filename and the process image path for the write/creation event.
references:
  - https://stealthbits.com/blog/extracting-password-hashes-from-the-ntds-dit-file/
  - https://adsecurity.org/?p=2398
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_ntds_dit_uncommon_process.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-01-11
modified: 2022-07-14
tags:
  - attack.credential-access
  - attack.t1003.002
  - attack.t1003.003
logsource:
  product: windows
  category: file_event
detection:
  selection_ntds:
    TargetFilename|endswith: \ntds.dit
  selection_process_img:
    Image|endswith:
      - \cmd.exe
      - \cscript.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \wscript.exe
      - \wsl.exe
      - \wt.exe
  selection_process_paths:
    Image|contains:
      - \AppData\
      - \Temp\
      - \Public\
      - \PerfLogs\
  condition: selection_ntds and 1 of selection_process_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1