Windows Ntdsutil Abuse via ESENT Events Containing ntds.dit

Flags ESENT application events mentioning ntds.dit that may indicate ntdsutil attempts to access the AD database.

FreeUnreviewedSigmamediumv1

windows-ntdsutil-abuse-via-esent-events-containing-ntds-dit-e6e88853

title: Windows Ntdsutil Abuse via ESENT Events Containing ntds.dit
id: c3856ac7-8656-4db8-9dff-d5843f3a8aab
status: test
description: This rule flags Windows application events where ESENT activity includes the string ntds.dit and the event IDs indicate related database handling (216, 325, 326, 327). Attackers may use ntdsutil to target and copy or access the Active Directory database, which can enable credential theft. The detection relies on Windows application logs with Provider_Name set to ESENT and the presence of ntds.dit in the recorded event data.
references:
  - https://twitter.com/mgreen27/status/1558223256704122882
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/esent/win_esent_ntdsutil_abuse.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-14
tags:
  - attack.credential-access
  - attack.t1003.003
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: ESENT
    EventID:
      - 216
      - 325
      - 326
      - 327
    Data|contains: ntds.dit
  condition: selection
falsepositives:
  - Legitimate backup operation/creating shadow copies
level: medium
license: DRL-1.1
related:
  - id: e6e88853-5f20-4c4a-8d26-cd469fd8d31f
    type: derived

What it detects

This rule flags Windows application events where ESENT activity includes the string ntds.dit and the event IDs indicate related database handling (216, 325, 326, 327). Attackers may use ntdsutil to target and copy or access the Active Directory database, which can enable credential theft. The detection relies on Windows application logs with Provider_Name set to ESENT and the presence of ntds.dit in the recorded event data.

Known false positives

Legitimate backup operation/creating shadow copies

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.