Detection rules › By eventESENT event 3252 detection rules reference this event. View event page.Sigma (2)Dump Ntds.dit To Suspicious Location severity mediumNtdsutil Abuse severity medium T1003.003