Windows PowerShell: Suspicious Get-ADDBAccount Reads ntds.dit via BootKey

Alerts on PowerShell invocations of Get-ADDBAccount that reference BootKey and DatabasePath for ntds.dit credential access.

FreeUnreviewedSigmahighv1

windows-powershell-suspicious-get-addbaccount-reads-ntds-dit-via-bootkey-b140afd9

title: "Windows PowerShell: Suspicious Get-ADDBAccount Reads ntds.dit via BootKey"
id: fd1ffc4f-7382-4fe2-85b8-fd7f9b25e0ec
status: test
description: This rule flags PowerShell module/script usage containing the Get-ADDBAccount command along with indicators for BootKey and DatabasePath, consistent with reading an ntds.dit source for credential material. Attackers can leverage this approach to obtain sensitive information without using common credential dumping tools. The detection relies on Windows PowerShell module telemetry by matching these substrings in the recorded payload content.
references:
  - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/
  - https://github.com/MichaelGrafnetter/DSInternals/blob/7ba59c12ee9a1cb430d7dc186a3366842dd612c8/Documentation/PowerShell/Get-ADDBAccount.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_get_addbaccount.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-16
tags:
  - attack.credential-access
  - attack.t1003.003
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection:
    Payload|contains|all:
      - Get-ADDBAccount
      - "BootKey "
      - "DatabasePath "
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b140afd9-474b-4072-958e-2ebb435abd68
    type: derived

What it detects

This rule flags PowerShell module/script usage containing the Get-ADDBAccount command along with indicators for BootKey and DatabasePath, consistent with reading an ntds.dit source for credential material. Attackers can leverage this approach to obtain sensitive information without using common credential dumping tools. The detection relies on Windows PowerShell module telemetry by matching these substrings in the recorded payload content.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.