{"id":"4e7050dd-e548-483f-b7d6-527ab4fa784d","title":"NTDS.DIT Creation By Uncommon Parent Process","description":"Detects creation of a file named \"ntds.dit\" (Active Directory Database) by an uncommon parent process or directory","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-03-11","modified":"2023-01-05","tags":["attack.credential-access","attack.t1003.003"],"technique_ids":["T1003.003"],"logsource":{"product":"windows","category":"file_event","definition":"Requirements: The \"ParentImage\" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enrich the log with additional ParentImage data"},"falsepositives":["Unknown"],"references":["https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration","https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/","https://pentestlab.blog/tag/ntds-dit/","https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1"],"source_path":"rules/windows/file/file_event/file_event_win_ntds_dit_uncommon_parent_process.yml","source_sha256":"7d93bc1e1fcc1da68188e1f4caeb68b881a350fbf1f63e266e63df0dbf8dc2d8","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_ntds_dit_uncommon_parent_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: NTDS.DIT Creation By Uncommon Parent Process\nid: 4e7050dd-e548-483f-b7d6-527ab4fa784d\nrelated:\n    - id: 11b1ed55-154d-4e82-8ad7-83739298f720\n      type: similar\nstatus: test\ndescription: Detects creation of a file named \"ntds.dit\" (Active Directory Database) by an uncommon parent process or directory\nreferences:\n    - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration\n    - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/\n    - https://pentestlab.blog/tag/ntds-dit/\n    - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-03-11\nmodified: 2023-01-05\ntags:\n    - attack.credential-access\n    - attack.t1003.003\nlogsource:\n    product: windows\n    category: file_event\n    definition: 'Requirements: The \"ParentImage\" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enrich the log with additional ParentImage data'\ndetection:\n    selection_file:\n        TargetFilename|endswith: '\\ntds.dit'\n    selection_process_parent:\n        # Note: ParentImage is a custom field and is not available by default on Sysmon EID 11\n        ParentImage|endswith:\n            - '\\cscript.exe'\n            - '\\httpd.exe'\n            - '\\nginx.exe'\n            - '\\php-cgi.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\w3wp.exe'\n            - '\\wscript.exe'\n    selection_process_parent_path:\n        # Note: ParentImage is a custom field and is not available by default on Sysmon EID 11\n        ParentImage|contains:\n            - '\\apache'\n            - '\\tomcat'\n            - '\\AppData\\'\n            - '\\Temp\\'\n            - '\\Public\\'\n            - '\\PerfLogs\\'\n    condition: selection_file and 1 of selection_process_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.003","id":"T1003.003","name":"NTDS","page":"techniques/enterprise/T1003.003/"}],"data_path":"data/detection-rules/4e7050dd-e548-483f-b7d6-527ab4fa784d.json","kind":"sigma"}