Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.