Sigma detection rules, expert-reviewed

Malicious NTDS.dit Extraction via ntdsutil IFM Snapshot (via process_creation)

This rule detects use of ntdsutil to create an install-from-media snapshot, the technique Storm-1175 uses to extract the NTDS.dit Active Directory database and steal domain credential hashes during Medusa ransomware operations. Adversaries dump NTDS.dit to obtain every domain account hash for offline cracking and mass lateral movement, so this command on a domain controller is a critical credential-access alert.

Malicious NTDS Database Dump via NTDSUtil in BlackSuit Ransomware

This rule detects ntdsutil being used to create an installation from media (IFM) copy of the Active Directory database, a credential-access technique observed in BlackSuit ransomware intrusions. Dumping NTDS.dit gives operators every domain hash for offline cracking and full domain compromise, making this a critical detection.

Malicious NTDS Database Extraction via Ntdsutil (via process_creation)

This rule detects ntdsutil creating a full copy of the Active Directory database, the credential theft step Volt Typhoon performs to obtain the domain NTDS.dit file and all account hashes. Dumping the directory database enables offline cracking and domain wide impersonation, so this operation on a domain controller is a high confidence indicator of hands on keyboard credential access.

Suspicious ntdsutil.exe Use for AD Snapshot Mount or Activation (Windows Process Creation)

Alerts on ntdsutil.exe command lines that include snapshot mount and activation/instance fragments, indicating potential AD snapshot manipulation.

Windows ntdsutil Abuse Indicators via ESENT Events Containing ntds.dit

Flags ESENT application events mentioning ntds.dit that may indicate ntdsutil attempts to access the AD database.

Windows: Execution of ntdsutil.exe for NTDS database operations

Flags execution of ntdsutil.exe, a utility that can be used to manipulate the NTDS database (NTDS.DIT).