Windows Process Creation: Detect NTDS.DIT and Registry Hive Exfiltration Tooling

title: "Windows Process Creation: Detect NTDS.DIT and Registry Hive Exfiltration Tooling"
id: 29c7e459-8a80-4480-a024-9ceb037bc509
status: test
description: This rule flags Windows process executions whose command lines reference NTDS.DIT and related SYSTEM hive access patterns commonly used to stage credential database exfiltration. It matches known dumping binaries by filename (NTDSDump/NTDSDumpEx) as well as PowerShell scripts containing NTDSgrab.ps1 and other NTDS/IFM-style one-liners (ntdsutil, copy commands, and related create full output). It relies on process creation telemetry including Image, CommandLine, and ParentImage, enabling detection of suspicious collection and staging activity based on how NTDS.DIT is referenced and where related artifacts are written.
references:
  - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
  - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/
  - https://pentestlab.blog/tag/ntds-dit/
  - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1
  - https://github.com/zcgonvh/NTDSDumpEx
  - https://github.com/rapid7/metasploit-framework/blob/d297adcebb5c1df6fe30b12ca79b161deb71571c/data/post/powershell/NTDSgrab.ps1
  - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_ntds.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-11
modified: 2022-11-10
tags:
  - attack.credential-access
  - attack.t1003.003
logsource:
  product: windows
  category: process_creation
detection:
  selection_tool:
    - Image|endswith:
        - \NTDSDump.exe
        - \NTDSDumpEx.exe
    - CommandLine|contains|all:
        - ntds.dit
        - system.hiv
    - CommandLine|contains: NTDSgrab.ps1
  selection_oneliner_1:
    CommandLine|contains|all:
      - ac i ntds
      - create full
  selection_onliner_2:
    CommandLine|contains|all:
      - "/c copy "
      - \windows\ntds\ntds.dit
  selection_onliner_3:
    CommandLine|contains|all:
      - activate instance ntds
      - create full
  selection_powershell:
    CommandLine|contains|all:
      - powershell
      - ntds.dit
  set1_selection_ntds_dit:
    CommandLine|contains: ntds.dit
  set1_selection_image_folder:
    - ParentImage|contains:
        - \apache
        - \tomcat
        - \AppData\
        - \Temp\
        - \Public\
        - \PerfLogs\
    - Image|contains:
        - \apache
        - \tomcat
        - \AppData\
        - \Temp\
        - \Public\
        - \PerfLogs\
  condition: 1 of selection* or all of set1*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8bc64091-6875-4881-aaf9-7bd25b5dda08
    type: derived