1200KM / tool
esentutl — Attack Tool
esentutl is a command-line tool that provides database utilities for the Windows Extensible Storage Engine.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: esentutl, esentutl.exe
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- menuPass · G0045 · Pinned relationship source (relationship--d608c524-ad0a-4595-8fe2-4a0ec0dbf501)
- Chimera · G0114 · Pinned relationship source (relationship--93bc896f-d2c2-4d6b-b231-fdc084aeed69)
- INC Ransom · G1032 · Pinned relationship source (relationship--bcbe375f-f724-4d85-a797-3a4008f7d1f5)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
- T1003.003 · NTDS · Detection rules & anomalies
- T1005 · Data from Local System · Detection rules & anomalies
- T1006 · Direct Volume Access · Detection rules & anomalies
- T1105 · Ingress Tool Transfer · Detection rules & anomalies
- T1564.004 · NTFS File Attributes · Detection rules & anomalies
- T1570 · Lateral Tool Transfer · Detection rules & anomalies
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
- Command Execution · DC0064
- File Access · DC0055
- File Creation · DC0039
- File Metadata · DC0059
- File Modification · DC0061
- Network Connection Creation · DC0082
- Network Share Access · DC0102
- Network Traffic Flow · DC0078
- OS API Execution · DC0021
- Process Access · DC0035
- Process Creation · DC0032
- Volume Creation · DC0097
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.