Detection rules › Sigma

Ntdsutil Abuse

Severity
medium
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects potential abuse of ntdsutil to dump ntds.dit database

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003.003 OS Credential Dumping: NTDS

Event coverage

ProviderEvent IDTitle
ESENT216
ESENT325
ESENT326
ESENT327

Stages and Predicates

Stage 1: selection

Data|contains: ntds.dit
Provider_Name: ESENT

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Datamatch
  • ntds.dit corpus 2 (sigma 2)
Provider_Nameeq
  • ESENT corpus 2 (sigma 2)