Windows Process Execution of DIT Snapshot Viewer (ditsnap.exe)

title: Windows Process Execution of DIT Snapshot Viewer (ditsnap.exe)
id: 7cfcce43-90a7-491c-a06e-ce437cb12dd1
status: test
description: This rule flags process creation events where an executable named ditsnap.exe is launched and where its command line includes the string 'ditsnap.exe'. DIT snapshot inspection of ntds.dit can support credential access or offline analysis workflows, making execution visibility important for detecting potential AD data harvesting. The detection relies on Windows process creation telemetry containing the image path and command line.
references:
  - https://thedfirreport.com/2020/06/21/snatch-ransomware/
  - https://web.archive.org/web/20201124182207/https://github.com/yosqueoy/ditsnap
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_ditsnap.yml
author: Furkan Caliskan (@caliskanfurkan_), Huntrule Team
date: 2020-07-04
modified: 2023-02-21
tags:
  - attack.credential-access
  - attack.t1003.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \ditsnap.exe
    - CommandLine|contains: ditsnap.exe
  condition: selection
falsepositives:
  - Legitimate admin usage
level: high
license: DRL-1.1
related:
  - id: d3b70aad-097e-409c-9df2-450f80dc476b
    type: derived