Sigma detection rules, expert-reviewed

Suspicious Active Directory Snapshot Creation via ntdsutil

This rule detects ntdsutil.exe creating and mounting a snapshot, a technique used by espionage actors targeting Asian governments to extract the Active Directory database and steal domain credentials.

Malicious NTDS Credential Dump via Ntdsutil IFM Snapshot (via process_creation)

This rule detects use of ntdsutil to create an Install From Media snapshot of the Active Directory database, a credential access technique used by actors following BeyondTrust CVE-2026-1731 exploitation. The IFM snapshot exports the NTDS.dit hive containing domain password hashes, enabling full domain compromise, so this activity should be treated as active credential theft.

Malicious NTDS Database Dump via ntdsutil

This rule detects use of ntdsutil to create a full copy of the Active Directory NTDS.dit database. This behavior matches BlackSuit ransomware operators who dump the domain credential store for offline extraction of password hashes. Access to NTDS.dit enables domain-wide credential compromise and is a high-severity precursor to lateral movement and full domain takeover.

Malicious NTDS Extraction via ntdsutil IFM

This rule detects ntdsutil creating an Install From Media snapshot to extract the Active Directory database. The StrikeShark Cobalt Strike campaign uses this to steal domain credentials from a domain controller. NTDS extraction through ntdsutil is a high-confidence credential-access indicator.

Malicious NTDS Extraction via Ntdsutil IFM

This rule detects ntdsutil creating an Install-From-Media snapshot, an technique the profiled APT actors use to dump the NTDS.dit domain database from a domain controller. The IFM path copies every domain credential hash in a single operation. Ntdsutil IFM runs are rare and high-value outside of documented backup jobs.

Malicious NTDS.dit Credential Extraction via ntdsutil

This rule detects ntdsutil being used to create a copy of the Active Directory NTDS.dit database, a credential dumping technique seen in Gootloader-enabled intrusions. Extracting NTDS.dit exposes every domain account hash for offline cracking and persistence. Interactive ntdsutil snapshots outside sanctioned maintenance are a strong compromise indicator.

Malicious NTDS.DIT Extraction via Ntdsutil IFM

This rule detects ntdsutil.exe creating an Install From Media set to extract the Active Directory database NTDS.DIT, a domain credential theft technique described by Huntress. Attackers dump NTDS.DIT to obtain every domain account hash for offline cracking and lateral movement. IFM creation outside of planned domain controller promotion is a critical credential-access event.

Malicious NTDS Extraction via Ntdsutil IFM Snapshot

This rule detects ntdsutil.exe creating an Install From Media snapshot which APT41 abuses to dump the Active Directory NTDS.dit database and SYSTEM hive from a domain controller. The technique harvests every domain credential hash for lateral movement. It is high value because legitimate IFM creation is rare and tightly scoped.

Malicious NTDS.dit Extraction via ntdsutil IFM

This rule detects use of ntdsutil.exe with Install-From-Media (IFM) arguments to create a full copy of the Active Directory database, a technique observed in RansomHub affiliate intrusions deploying EDRKillShifter. Dumping NTDS.dit exposes every domain account hash and enables domain-wide credential compromise ahead of ransomware deployment.

Malicious NTDS Database Dump via Ntdsutil IFM (via process_creation)

This rule detects ntdsutil.exe invoked with the Install-From-Media create full option to dump the Active Directory NTDS database, a credential-theft step performed during Operation Jacana. Exporting NTDS.dit yields all domain password hashes and enables full domain compromise.

Active Directory Database Dump via Ntdsutil IFM

This rule detects ntdsutil.exe creating an Install From Media snapshot to dump the ntds.dit Active Directory database, a domain credential theft step observed in the DeadRinger campaign against telcos. Extracting ntds.dit yields every domain account hash and is a high-impact credential access technique.

Malicious NTDS.dit Extraction via Ntdsutil (via process_creation)

This rule detects ntdsutil creating an Install From Media snapshot of the Active Directory database, the domain credential theft step used in Rhysida ransomware intrusions. Dumping NTDS.dit exposes every domain hash and is a high-severity precursor to full domain compromise.

Malicious NTDS Extraction via ntdsutil IFM (via process_creation)

This rule detects use of ntdsutil to create an Install From Media copy of the Active Directory database. Qilin ransomware operators ran ntdsutil with the ifm create full arguments to extract the NTDS database and registry hives for offline credential harvesting.

Malicious Active Directory Database Dump via ntdsutil IFM (via process_creation)

This rule detects ntdsutil.exe invoked to create a full Install-From-Media snapshot of the Active Directory database, the credential-dumping step observed on domain controllers prior to NTDS.dit exfiltration. Adversaries leverage ntdsutil to extract every domain hash in one operation, making detection of the IFM and full snapshot subcommands critical for catching domain-wide credential theft.

Malicious NTDS Extraction via Ntdsutil IFM Media Creation

This rule detects use of ntdsutil to create an install from media snapshot which extracts the Active Directory database and this technique was used during the NetSupport intrusion to steal the domain credential store and this matters because IFM creation dumps every domain hash in one operation and is almost never run by legitimate operators outside of controlled domain controller provisioning.