Windows Process Creation: Detect NTDS.DIT and Registry Hive Exfiltration Tooling
Detects suspicious Windows processes that reference NTDS.DIT/SYSTEM hive dumping or staging via common NTDS tooling and scripts.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-03-11
- Updated
- 2026-07-30
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process executions whose command lines reference NTDS.DIT and related SYSTEM hive access patterns commonly used to stage credential database exfiltration. It matches known dumping binaries by filename (NTDSDump/NTDSDumpEx) as well as PowerShell scripts containing NTDSgrab.ps1 and other NTDS/IFM-style one-liners (ntdsutil, copy commands, and related create full output). It relies on process creation telemetry including Image, CommandLine, and ParentImage, enabling detection of suspicious collection and staging activity based on how NTDS.DIT is referenced and where related artifacts are written.
Reporting behind it
- ired.teamhttps://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
- n00py.iohttps://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/
- pentestlab.bloghttps://pentestlab.blog/tag/ntds-dit/
- github.comhttps://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1
- github.comhttps://github.com/zcgonvh/NTDSDumpEx
- github.comhttps://github.com/rapid7/metasploit-framework/blob/d297adcebb5c1df6fe30b12ca79b161deb71571c/data/post/powershell/NTDSgrab.ps1
- blog.talosintelligence.comhttps://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_ntds.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Detect NTDS.DIT and Registry Hive Exfiltration Tooling"
id: 29c7e459-8a80-4480-a024-9ceb037bc509
status: test
description: This rule flags Windows process executions whose command lines reference NTDS.DIT and related SYSTEM hive access patterns commonly used to stage credential database exfiltration. It matches known dumping binaries by filename (NTDSDump/NTDSDumpEx) as well as PowerShell scripts containing NTDSgrab.ps1 and other NTDS/IFM-style one-liners (ntdsutil, copy commands, and related create full output). It relies on process creation telemetry including Image, CommandLine, and ParentImage, enabling detection of suspicious collection and staging activity based on how NTDS.DIT is referenced and where related artifacts are written.
references:
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
- https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/
- https://pentestlab.blog/tag/ntds-dit/
- https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1
- https://github.com/zcgonvh/NTDSDumpEx
- https://github.com/rapid7/metasploit-framework/blob/d297adcebb5c1df6fe30b12ca79b161deb71571c/data/post/powershell/NTDSgrab.ps1
- https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_ntds.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-03-11
modified: 2022-11-10
tags:
- attack.credential-access
- attack.t1003.003
logsource:
product: windows
category: process_creation
detection:
selection_tool:
- Image|endswith:
- \NTDSDump.exe
- \NTDSDumpEx.exe
- CommandLine|contains|all:
- ntds.dit
- system.hiv
- CommandLine|contains: NTDSgrab.ps1
selection_oneliner_1:
CommandLine|contains|all:
- ac i ntds
- create full
selection_onliner_2:
CommandLine|contains|all:
- "/c copy "
- \windows\ntds\ntds.dit
selection_onliner_3:
CommandLine|contains|all:
- activate instance ntds
- create full
selection_powershell:
CommandLine|contains|all:
- powershell
- ntds.dit
set1_selection_ntds_dit:
CommandLine|contains: ntds.dit
set1_selection_image_folder:
- ParentImage|contains:
- \apache
- \tomcat
- \AppData\
- \Temp\
- \Public\
- \PerfLogs\
- Image|contains:
- \apache
- \tomcat
- \AppData\
- \Temp\
- \Public\
- \PerfLogs\
condition: 1 of selection* or all of set1*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 8bc64091-6875-4881-aaf9-7bd25b5dda08
type: derived