Windows File Creation with NTDS-DIT Exfiltration Filename Patterns

title: Windows File Creation with NTDS-DIT Exfiltration Filename Patterns
id: 295198c3-c991-4d20-bf49-f90d2dddce06
status: test
description: This rule flags Windows file creation events where the target filename ends with NTDS-related exfiltration naming patterns (e.g., .ntds.cleartext or \All.cab). Attackers often package or dump directory database material (NTDS.DIT) into predictable filenames to stage data for copying or exfiltration. It relies on Windows file event telemetry that records the target filename used in the file creation.
references:
  - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/post/windows/gather/ntds_grabber.rb
  - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/data/post/powershell/NTDSgrab.ps1
  - https://github.com/SecureAuthCorp/impacket/blob/7d2991d78836b376452ca58b3d14daa61b67cb40/impacket/examples/secretsdump.py#L2405
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_ntds_exfil_tools.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-11
modified: 2023-05-05
tags:
  - attack.credential-access
  - attack.t1003.003
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - \All.cab
      - .ntds.cleartext
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 3a8da4e0-36c1-40d2-8b29-b3e890d5172a
    type: derived