Windows NTDS Exfiltration File Creation by NTDS Export Filename Patterns
Alerts on Windows file creates using common NTDS-DIT dump/exfiltration filename suffixes like \All.cab and .ntds.cleartext.
- Product
- windows
- Category
- file_event
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-03-11
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows file creation events where the target filename ends with specific NTDS export-related suffixes (\All.cab or .ntds.cleartext). Attackers who extract or stage NTDS.DIT contents may write these tool-specific output files prior to collection or exfiltration. Telemetry required includes Windows file event logs that record the created file’s full target filename.
Reporting behind it
- github.comhttps://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/post/windows/gather/ntds_grabber.rb
- github.comhttps://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/data/post/powershell/NTDSgrab.ps1
- github.comhttps://github.com/SecureAuthCorp/impacket/blob/7d2991d78836b376452ca58b3d14daa61b67cb40/impacket/examples/secretsdump.py#L2405
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_ntds_exfil_tools.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows NTDS Exfiltration File Creation by NTDS Export Filename Patterns
id: 295198c3-c991-4d20-bf49-f90d2dddce06
status: test
description: This rule flags Windows file creation events where the target filename ends with specific NTDS export-related suffixes (\All.cab or .ntds.cleartext). Attackers who extract or stage NTDS.DIT contents may write these tool-specific output files prior to collection or exfiltration. Telemetry required includes Windows file event logs that record the created file’s full target filename.
references:
- https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/post/windows/gather/ntds_grabber.rb
- https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/data/post/powershell/NTDSgrab.ps1
- https://github.com/SecureAuthCorp/impacket/blob/7d2991d78836b376452ca58b3d14daa61b67cb40/impacket/examples/secretsdump.py#L2405
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_ntds_exfil_tools.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-11
modified: 2023-05-05
tags:
- attack.credential-access
- attack.t1003.003
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|endswith:
- \All.cab
- .ntds.cleartext
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 3a8da4e0-36c1-40d2-8b29-b3e890d5172a
type: derived