Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe) — Sigma Rule

Rule metadata and linked tags

Author: Nasreddine Bencherchali (Nextron Systems). Source status: test; severity: medium. Source dates: 2022-09-14 / not supplied.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 1ca3b6390715b68df315eaef03b089d6b8419d3bd3a1cd24bb1c98bc92da1f14

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)
id: a58353df-af43-4753-bad0-cd83ef35eef5
related:
    - id: 2afafd61-6aae-4df4-baed-139fa1f4c345
      type: derived
status: test
description: Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731620(v=ws.11)
    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-09-14
tags:
    - attack.credential-access
    - attack.t1003.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\ntdsutil.exe'
        - OriginalFileName: 'ntdsutil.exe'
    selection_cli:
        - CommandLine|contains|all:
              - 'snapshot'
              - 'mount ' # mounts a specific snapshot - Ex: ntdsutil snapshot "mount c2b3e2c6-1ffb-4625-ba8e-3503c27a9fcb" quit quit
        - CommandLine|contains|all:
              # This offers more coverage to the "selection_oneliner_1" case in rule 8bc64091-6875-4881-aaf9-7bd25b5dda08
              # The shorest form of "activate" can "ac". But "act", "acti"...etc are also valid forms
              # Same case with the "instance" flag
              - 'ac'
              - ' i'
              - ' ntds'
    condition: all of selection_*
falsepositives:
    - Legitimate usage to restore snapshots
    - Legitimate admin activity
level: medium

Original YAML and metadata in JSON

False positives

• Legitimate usage to restore snapshots
• Legitimate admin activity

Source references

• https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731620(v=ws.11)
• https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments