Windows File Events: ntds.dit Created

Flags creation of an ntds.dit file on Windows, an Active Directory database artifact often associated with credential access.

FreeUnreviewedSigmalowv1

windows-file-events-ntds-dit-created-0b8baa3f

title: "Windows File Events: ntds.dit Created"
id: 80190794-3aac-41de-8da4-89ea84d12bd5
status: test
description: This rule matches Windows file creation events where the target filename ends with "ntds.dit", the Active Directory database file. Attackers may create or manipulate ntds.dit to access or stage directory credential data, so this event can indicate potential credential-access activity. It relies on file event telemetry that includes the target filename for created files.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_ntds_dit_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-05
tags:
  - attack.credential-access
  - attack.t1003.003
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith: ntds.dit
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 0b8baa3f-575c-46ee-8715-d6f28cc7d33c
    type: derived

What it detects

This rule matches Windows file creation events where the target filename ends with "ntds.dit", the Active Directory database file. Attackers may create or manipulate ntds.dit to access or stage directory credential data, so this event can indicate potential credential-access activity. It relies on file event telemetry that includes the target filename for created files.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.