Windows ntdsutil Abuse Indicators via ESENT Events Containing ntds.dit

Flags ESENT application events mentioning ntds.dit that may indicate ntdsutil attempts to access the AD database.

FreeReviewedSigma · Medium · v2

Product: windows
Service: application
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-08-14
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.003NTDS
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows application telemetry where ESENT-related events (Event IDs 216, 325, 326, and 327) include the string "ntds.dit" in event data. Attackers may use ntdsutil to access or extract Active Directory database contents, making this indicator valuable for credential-access investigations. It relies on Windows application logs with ESENT provider events and event fields that contain the ntds.dit identifier.

Reporting behind it

Related detections9 linkedT1003.003 — drag to rearrange

Malicious NTDS Credential Dump via Ntdsutil IFM Snapshot (via process_creation)

Malicious NTDS Database Dump via ntdsutil

Malicious NTDS Extraction from Volume Shadow Copy by RA World

Malicious NTDS Extraction via ntdsutil IFM

Malicious NTDS.dit Access via Shadow Copy GLOBALROOT Path

Suspicious Shadow Copy Creation via WMIC (via process_creation)

Malicious NTDS Extraction via Ntdsutil IFM

Malicious NTDS.dit Credential Extraction via ntdsutil

Malicious NTDS Credential Theft via Wbadmin Backup

Windows ntdsutil Abuse Indicators via ESENT Events Containing ntds.dit

Pivot detection · T1003.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-ntdsutil-abuse-via-esent-events-containing-ntds-dit-e6e88853

title: Windows ntdsutil Abuse Indicators via ESENT Events Containing ntds.dit
id: c3856ac7-8656-4db8-9dff-d5843f3a8aab
status: test
description: This rule flags Windows application telemetry where ESENT-related events (Event IDs 216, 325, 326, and 327) include the string "ntds.dit" in event data. Attackers may use ntdsutil to access or extract Active Directory database contents, making this indicator valuable for credential-access investigations. It relies on Windows application logs with ESENT provider events and event fields that contain the ntds.dit identifier.
references:
  - https://twitter.com/mgreen27/status/1558223256704122882
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11)
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/esent/win_esent_ntdsutil_abuse.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-14
tags:
  - attack.credential-access
  - attack.t1003.003
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: ESENT
    EventID:
      - 216
      - 325
      - 326
      - 327
    Data|contains: ntds.dit
  condition: selection
falsepositives:
  - Legitimate backup operation/creating shadow copies
level: medium
license: DRL-1.1
related:
  - id: e6e88853-5f20-4c4a-8d26-cd469fd8d31f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL