{"id":"8bc64091-6875-4881-aaf9-7bd25b5dda08","title":"Suspicious Process Patterns NTDS.DIT Exfil","description":"Detects suspicious process patterns used in NTDS.DIT exfiltration","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-03-11","modified":"2022-11-10","tags":["attack.credential-access","attack.t1003.003"],"technique_ids":["T1003.003"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration","https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/","https://pentestlab.blog/tag/ntds-dit/","https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1","https://github.com/zcgonvh/NTDSDumpEx","https://github.com/rapid7/metasploit-framework/blob/d297adcebb5c1df6fe30b12ca79b161deb71571c/data/post/powershell/NTDSgrab.ps1","https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_ntds.yml","source_sha256":"ee87b516424a392320b758fdb48f4d0083d65c6a297bd1804bd99abeda27e682","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_ntds.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Process Patterns NTDS.DIT Exfil\nid: 8bc64091-6875-4881-aaf9-7bd25b5dda08\nstatus: test\ndescription: Detects suspicious process patterns used in NTDS.DIT exfiltration\nreferences:\n    - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration\n    - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/\n    - https://pentestlab.blog/tag/ntds-dit/\n    - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1\n    - https://github.com/zcgonvh/NTDSDumpEx\n    - https://github.com/rapid7/metasploit-framework/blob/d297adcebb5c1df6fe30b12ca79b161deb71571c/data/post/powershell/NTDSgrab.ps1\n    - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-03-11\nmodified: 2022-11-10\ntags:\n    - attack.credential-access\n    - attack.t1003.003\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_tool:\n        # https://github.com/zcgonvh/NTDSDumpEx\n        - Image|endswith:\n              - '\\NTDSDump.exe'\n              - '\\NTDSDumpEx.exe'\n        - CommandLine|contains|all:\n              # ntdsdumpex.exe -d ntds.dit -o hash.txt -s system.hiv\n              - 'ntds.dit'\n              - 'system.hiv'\n        - CommandLine|contains: 'NTDSgrab.ps1'\n    selection_oneliner_1:\n        # powershell \"ntdsutil.exe 'ac i ntds' 'ifm' 'create full c:\\temp' q q\"\n        CommandLine|contains|all:\n            - 'ac i ntds'\n            - 'create full'\n    selection_onliner_2:\n        # cmd.exe /c copy z:\\windows\\ntds\\ntds.dit c:\\exfil\\ntds.dit\n        CommandLine|contains|all:\n            - '/c copy '\n            - '\\windows\\ntds\\ntds.dit'\n    selection_onliner_3:\n        # ntdsutil \"activate instance ntds\" \"ifm\" \"create full c:\\windows\\temp\\data\\\" \"quit\" \"quit\"\n        CommandLine|contains|all:\n            - 'activate instance ntds'\n            - 'create full'\n    selection_powershell:\n        CommandLine|contains|all:\n            - 'powershell'\n            - 'ntds.dit'\n    set1_selection_ntds_dit:\n        CommandLine|contains: 'ntds.dit'\n    set1_selection_image_folder:\n        - ParentImage|contains:\n              - '\\apache'\n              - '\\tomcat'\n              - '\\AppData\\'\n              - '\\Temp\\'\n              - '\\Public\\'\n              - '\\PerfLogs\\'\n        - Image|contains:\n              - '\\apache'\n              - '\\tomcat'\n              - '\\AppData\\'\n              - '\\Temp\\'\n              - '\\Public\\'\n              - '\\PerfLogs\\'\n    condition: 1 of selection* or all of set1*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.003","id":"T1003.003","name":"NTDS","page":"techniques/enterprise/T1003.003/"}],"data_path":"data/detection-rules/8bc64091-6875-4881-aaf9-7bd25b5dda08.json","kind":"sigma"}