Windows ntdsutil Abuse Indicators via ESENT Events Containing ntds.dit
Flags ESENT application events mentioning ntds.dit that may indicate ntdsutil attempts to access the AD database.
- Product
- windows
- Service
- application
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-14
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows application telemetry where ESENT-related events (Event IDs 216, 325, 326, and 327) include the string "ntds.dit" in event data. Attackers may use ntdsutil to access or extract Active Directory database contents, making this indicator valuable for credential-access investigations. It relies on Windows application logs with ESENT provider events and event fields that contain the ntds.dit identifier.
Reporting behind it
- twitter.comhttps://twitter.com/mgreen27/status/1558223256704122882
- learn.microsoft.comhttps://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11)
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/esent/win_esent_ntdsutil_abuse.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows ntdsutil Abuse Indicators via ESENT Events Containing ntds.dit
id: c3856ac7-8656-4db8-9dff-d5843f3a8aab
status: test
description: This rule flags Windows application telemetry where ESENT-related events (Event IDs 216, 325, 326, and 327) include the string "ntds.dit" in event data. Attackers may use ntdsutil to access or extract Active Directory database contents, making this indicator valuable for credential-access investigations. It relies on Windows application logs with ESENT provider events and event fields that contain the ntds.dit identifier.
references:
- https://twitter.com/mgreen27/status/1558223256704122882
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11)
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/esent/win_esent_ntdsutil_abuse.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-14
tags:
- attack.credential-access
- attack.t1003.003
logsource:
product: windows
service: application
detection:
selection:
Provider_Name: ESENT
EventID:
- 216
- 325
- 326
- 327
Data|contains: ntds.dit
condition: selection
falsepositives:
- Legitimate backup operation/creating shadow copies
level: medium
license: DRL-1.1
related:
- id: e6e88853-5f20-4c4a-8d26-cd469fd8d31f
type: derived