Windows Process Creation: esentutl Access with /p for NTDS/credentials files

Flags Windows executions of esentutl when used with the /p parameter to access credentials-related files.

FreeUnreviewedSigmamediumv1

windows-process-creation-esentutl-access-with-p-for-ntds-credentials-files-7df1713a

title: "Windows Process Creation: esentutl Access with /p for NTDS/credentials files"
id: c388d0a4-4e8c-48d1-8b81-5c90a98af87b
status: test
description: This rule matches Windows process creation events where the command line contains both "esentutl" and " /p", indicating an esentutl invocation that targets a file path. Attackers may use esentutl to access credentials-related artifacts (e.g., files such as NTDS) without needing interactive UI access. The detection relies on process creation telemetry and the command line content present in the event.
references:
  - https://twitter.com/vxunderground/status/1423336151860002816
  - https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_esentutl_params.yml
author: sam0x90, Huntrule Team
date: 2021-08-06
modified: 2022-10-09
tags:
  - attack.credential-access
  - attack.t1003
  - attack.t1003.003
  - attack.s0404
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - esentutl
      - " /p"
  condition: selection
falsepositives:
  - To be determined
level: medium
license: DRL-1.1
related:
  - id: 7df1713a-1a5b-4a4b-a071-dc83b144a101
    type: derived

What it detects

This rule matches Windows process creation events where the command line contains both "esentutl" and " /p", indicating an esentutl invocation that targets a file path. Attackers may use esentutl to access credentials-related artifacts (e.g., files such as NTDS) without needing interactive UI access. The detection relies on process creation telemetry and the command line content present in the event.

Known false positives

To be determined

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.