Sigma detection rules, expert-reviewed

Suspicious Active Directory Snapshot Creation via ntdsutil

This rule detects ntdsutil.exe creating and mounting a snapshot, a technique used by espionage actors targeting Asian governments to extract the Active Directory database and steal domain credentials.

Malicious NTDS Credential Dump via Ntdsutil IFM Snapshot (via process_creation)

This rule detects use of ntdsutil to create an Install From Media snapshot of the Active Directory database, a credential access technique used by actors following BeyondTrust CVE-2026-1731 exploitation. The IFM snapshot exports the NTDS.dit hive containing domain password hashes, enabling full domain compromise, so this activity should be treated as active credential theft.

Malicious NTDS Database Dump via ntdsutil

This rule detects use of ntdsutil to create a full copy of the Active Directory NTDS.dit database. This behavior matches BlackSuit ransomware operators who dump the domain credential store for offline extraction of password hashes. Access to NTDS.dit enables domain-wide credential compromise and is a high-severity precursor to lateral movement and full domain takeover.

Malicious NTDS Extraction from Volume Shadow Copy by RA World

This rule detects copying of the Active Directory database or SAM and SYSTEM hives out of a volume shadow copy through a GLOBALROOT HarddiskVolumeShadowCopy path, a credential theft step used by the RA World ransomware group. Reading domain secrets from a shadow copy bypasses locks on the live files. Detecting this exposes domain credential harvesting ahead of ransomware deployment.

Malicious NTDS Extraction via ntdsutil IFM

This rule detects ntdsutil creating an Install From Media snapshot to extract the Active Directory database. The StrikeShark Cobalt Strike campaign uses this to steal domain credentials from a domain controller. NTDS extraction through ntdsutil is a high-confidence credential-access indicator.

Malicious NTDS.dit Access via Shadow Copy GLOBALROOT Path

This rule detects access to ntds.dit through a GLOBALROOT volume shadow copy device path. The CloudComputating group copied the Active Directory database directly from a shadow copy to steal domain credentials while bypassing file locks on the live NTDS.dit.

Malicious NTDS Extraction via Ntdsutil IFM

This rule detects ntdsutil creating an Install-From-Media snapshot, an technique the profiled APT actors use to dump the NTDS.dit domain database from a domain controller. The IFM path copies every domain credential hash in a single operation. Ntdsutil IFM runs are rare and high-value outside of documented backup jobs.

Malicious NTDS.dit Credential Extraction via ntdsutil

This rule detects ntdsutil being used to create a copy of the Active Directory NTDS.dit database, a credential dumping technique seen in Gootloader-enabled intrusions. Extracting NTDS.dit exposes every domain account hash for offline cracking and persistence. Interactive ntdsutil snapshots outside sanctioned maintenance are a strong compromise indicator.

Malicious NTDS Credential Theft via Wbadmin Backup

This rule detects wbadmin being used to back up or recover the Active Directory database NTDS.dit, an approach attackers use to extract domain credential hashes offline. This was observed after SonicWall VPN exploitation during Akira intrusions. Access to NTDS.dit yields all domain password hashes and enables full domain compromise.

Malicious NTDS.DIT Extraction via Ntdsutil IFM

This rule detects ntdsutil.exe creating an Install From Media set to extract the Active Directory database NTDS.DIT, a domain credential theft technique described by Huntress. Attackers dump NTDS.DIT to obtain every domain account hash for offline cracking and lateral movement. IFM creation outside of planned domain controller promotion is a critical credential-access event.

Malicious NTDS Extraction via Ntdsutil IFM Snapshot

This rule detects ntdsutil.exe creating an Install From Media snapshot which APT41 abuses to dump the Active Directory NTDS.dit database and SYSTEM hive from a domain controller. The technique harvests every domain credential hash for lateral movement. It is high value because legitimate IFM creation is rare and tightly scoped.

Malicious NTDS.dit Extraction via ntdsutil IFM

This rule detects use of ntdsutil.exe with Install-From-Media (IFM) arguments to create a full copy of the Active Directory database, a technique observed in RansomHub affiliate intrusions deploying EDRKillShifter. Dumping NTDS.dit exposes every domain account hash and enables domain-wide credential compromise ahead of ransomware deployment.

Malicious NTDS Database Dump via Ntdsutil IFM (via process_creation)

This rule detects ntdsutil.exe invoked with the Install-From-Media create full option to dump the Active Directory NTDS database, a credential-theft step performed during Operation Jacana. Exporting NTDS.dit yields all domain password hashes and enables full domain compromise.

Suspicious Active Directory Database Theft via ntds.dit Access

This rule detects command lines that reference the ntds.dit Active Directory database alongside ntdsutil or volume shadow copy operations used to extract it. Copying ntds.dit from a domain controller yields the password hashes for every domain account.

Active Directory Database Dump via Ntdsutil IFM

This rule detects ntdsutil.exe creating an Install From Media snapshot to dump the ntds.dit Active Directory database, a domain credential theft step observed in the DeadRinger campaign against telcos. Extracting ntds.dit yields every domain account hash and is a high-impact credential access technique.