{"id":"a58353df-af43-4753-bad0-cd83ef35eef5","title":"Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)","description":"Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-09-14","modified":"","tags":["attack.credential-access","attack.t1003.003"],"technique_ids":["T1003.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate usage to restore snapshots","Legitimate admin activity"],"references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731620(v=ws.11)","https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments"],"source_path":"rules/windows/process_creation/proc_creation_win_ntdsutil_susp_usage.yml","source_sha256":"1ca3b6390715b68df315eaef03b089d6b8419d3bd3a1cd24bb1c98bc92da1f14","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_ntdsutil_susp_usage.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)\nid: a58353df-af43-4753-bad0-cd83ef35eef5\nrelated:\n    - id: 2afafd61-6aae-4df4-baed-139fa1f4c345\n      type: derived\nstatus: test\ndescription: Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.\nreferences:\n    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731620(v=ws.11)\n    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-09-14\ntags:\n    - attack.credential-access\n    - attack.t1003.003\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\ntdsutil.exe'\n        - OriginalFileName: 'ntdsutil.exe'\n    selection_cli:\n        - CommandLine|contains|all:\n              - 'snapshot'\n              - 'mount ' # mounts a specific snapshot - Ex: ntdsutil snapshot \"mount c2b3e2c6-1ffb-4625-ba8e-3503c27a9fcb\" quit quit\n        - CommandLine|contains|all:\n              # This offers more coverage to the \"selection_oneliner_1\" case in rule 8bc64091-6875-4881-aaf9-7bd25b5dda08\n              # The shorest form of \"activate\" can \"ac\". But \"act\", \"acti\"...etc are also valid forms\n              # Same case with the \"instance\" flag\n              - 'ac'\n              - ' i'\n              - ' ntds'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate usage to restore snapshots\n    - Legitimate admin activity\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.003","id":"T1003.003","name":"NTDS","page":"techniques/enterprise/T1003.003/"}],"data_path":"data/detection-rules/a58353df-af43-4753-bad0-cd83ef35eef5.json","kind":"sigma"}