Sigma detection rules, expert-reviewed

Malicious NTDS.dit Access via esentutl Database Copy (via process_creation)

This rule detects esentutl.exe operating on the ntds.dit Active Directory database file, an operation used during this intrusion to copy or process the domain credential store extracted from a volume shadow copy. Adversaries leverage the esentutl LOLBin to handle the locked database and recover hashes, making detection of ntds.dit in its command line a strong credential-access signal.

Malicious Active Directory Database (NTDS.dit) Extraction (via process_creation)

This rule detects extraction of the Active Directory database via ntdsutil Install-From-Media snapshots or shadow-copy access to ntds.dit, which yields every domain credential hash for offline cracking and forging. NTDS credential access is a high-impact technique in the Red Canary Threat Detection Report and a common precursor to domain-wide compromise. Detecting these extraction commands surfaces a domain-controller-level credential theft.

Windows Print.EXE Sensitive File Dump for Credential Access

Alerts when Print.EXE is executed with arguments targeting ntds.dit, SAM, SECURITY, and SYSTEM files for credential access.

Windows: wbadmin.exe Used to Recover/Dump Sensitive Registry Hives and NTDS.dit

Alert on wbadmin.exe recovery commands targeting SAM/SECURITY/SYSTEM hives and NTDS.dit.

Windows Process Creation: wbadmin.exe Triggered for Backup of Sensitive Registry and NTDS Files

Alerts on wbadmin.exe backup commands that reference SAM/SECURITY/SYSTEM hives or NTDS.DIT.

Windows: File Creation of NTDS.DIT (Active Directory Database)

Flags creation of an ntds.dit file on Windows, an Active Directory database artifact often associated with credential access.

Suspicious ntdsutil.exe Use for AD Snapshot Mount or Activation (Windows Process Creation)

Alerts on ntdsutil.exe command lines that include snapshot mount and activation/instance fragments, indicating potential AD snapshot manipulation.

Windows: Detect ESENT New Database Created with ntds.dit Written to Suspicious Path

Identifies ESENT EventID 325 where a new database containing ntds.dit is created in suspicious locations.

Windows ntdsutil Abuse Indicators via ESENT Events Containing ntds.dit

Flags ESENT application events mentioning ntds.dit that may indicate ntdsutil attempts to access the AD database.

Windows PowerShell: Suspicious Get-ADDBAccount access to ntds.dit via BootKey and DatabasePath

Alerts on PowerShell invocations of Get-ADDBAccount that reference BootKey and DatabasePath for ntds.dit credential access.

Windows Process Creation: Detect NTDS.DIT and Registry Hive Exfiltration Tooling

Detects suspicious Windows processes that reference NTDS.DIT/SYSTEM hive dumping or staging via common NTDS tooling and scripts.

Windows NTDS Exfiltration File Creation by NTDS Export Filename Patterns

Alerts on Windows file creates using common NTDS-DIT dump/exfiltration filename suffixes like \All.cab and .ntds.cleartext.

Windows File Events: NTDS.DIT Created by Suspicious or Rare Process

Alerts on creation of ntds.dit on Windows when the creator process image/path is uncommon or located in suspicious directories.

Windows: Detect esentutl.exe Copying Sensitive Credential Files via VSS

Alerts on esentutl.exe VSS usage and command lines referencing SAM/SECURITY/SYSTEM or ntds.dit copy targets.

Windows: Execution of ntdsutil.exe for NTDS database operations

Flags execution of ntdsutil.exe, a utility that can be used to manipulate the NTDS database (NTDS.DIT).