Sigma rule: Suspicious Process Patterns NTDS.DIT Exfil

Rule

Title

Suspicious Process Patterns NTDS.DIT Exfil

Status

test

Level

high

Author

Florian Roth (Nextron Systems)

Date

2022-03-11

Modified

2022-11-10

File

rules/windows/process_creation/proc_creation_win_susp_ntds.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious process patterns used in NTDS.DIT exfiltration

Log source

product

windows

category

process_creation

Detection

selection_tool:
    # https://github.com/zcgonvh/NTDSDumpEx
    - Image|endswith:
          - '\NTDSDump.exe'
          - '\NTDSDumpEx.exe'
    - CommandLine|contains|all:
          # ntdsdumpex.exe -d ntds.dit -o hash.txt -s system.hiv
          - 'ntds.dit'
          - 'system.hiv'
    - CommandLine|contains: 'NTDSgrab.ps1'
selection_oneliner_1:
    # powershell "ntdsutil.exe 'ac i ntds' 'ifm' 'create full c:\temp' q q"
    CommandLine|contains|all:
        - 'ac i ntds'
        - 'create full'
selection_onliner_2:
    # cmd.exe /c copy z:\windows\ntds\ntds.dit c:\exfil\ntds.dit
    CommandLine|contains|all:
        - '/c copy '
        - '\windows\ntds\ntds.dit'
selection_onliner_3:
    # ntdsutil "activate instance ntds" "ifm" "create full c:\windows\temp\data\" "quit" "quit"
    CommandLine|contains|all:
        - 'activate instance ntds'
        - 'create full'
selection_powershell:
    CommandLine|contains|all:
        - 'powershell'
        - 'ntds.dit'
set1_selection_ntds_dit:
    CommandLine|contains: 'ntds.dit'
set1_selection_image_folder:
    - ParentImage|contains:
          - '\apache'
          - '\tomcat'
          - '\AppData\'
          - '\Temp\'
          - '\Public\'
          - '\PerfLogs\'
    - Image|contains:
          - '\apache'
          - '\tomcat'
          - '\AppData\'
          - '\Temp\'
          - '\Public\'
          - '\PerfLogs\'
condition: 1 of selection* or all of set1*

False positives (as the rule lists them)

• Unknown

Tags

• attack.credential-access
• attack.t1003.003

MITRE ATT&CK ids this rule names

• T1003.003

References

• https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
• https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/
• https://pentestlab.blog/tag/ntds-dit/
• https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1
• https://github.com/zcgonvh/NTDSDumpEx
• https://github.com/rapid7/metasploit-framework/blob/d297adcebb5c1df6fe30b12ca79b161deb71571c/data/post/powershell/NTDSgrab.ps1
• https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_susp_ntds.yml