Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
274 detections
Filters
Last updated
All Time
Detection languages
116
97
21
13
9
Contributors
57
50
47
36
28
Categories
163
147
109
63
38
Platforms
268
6
4
1
1
Products / Services
98
88
48
25
19
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
1
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects access to NTDS.dit for Active Directory credential dumping
This rule detects attempts to acquire Windows credentials by accessing critical registry hives (SAM, SYSTEM, SECURITY) or their shadow copies. It looks for the use of 'reg save' to export hives, as well as direct file access to these hives or their shadow copy variations by non-standard system processes.
Detects the use of the native Windows utility ntdsutil.exe with arguments 'ac i ntds' or 'ifm', which are commonly used to perform an 'Install from Media' (IFM) operation. This technique is frequently abused by adversaries to create a snapshot of the Active Directory database (ntds.dit) and the SYSTEM registry hive, facilitating offline credential dumping.
Detects the use of the native Windows utility ntdsutil.exe with arguments 'ac i ntds' or 'ifm', which are commonly used to perform an 'Install from Media' (IFM) operation. This technique is frequently abused by adversaries to create a snapshot of the Active Directory database (ntds.dit) and the SYSTEM registry hive, facilitating offline credential dumping.
Detects the creation of a file named 'NTDS.zip', which is a common naming convention used by adversaries when compressing the Active Directory database (NTDS.dit) for staging and subsequent exfiltration.
Detects Active Directory object access events (Event ID 4662) associated with domain controller replication rights (Replication-Get-Changes or Replication-Get-Changes-All). This behavior is often associated with credential dumping techniques like DCSync, where an attacker impersonates a domain controller to request replication of sensitive data, such as password hashes, from another domain controller.
Detects Active Directory object access events (Event ID 4662) associated with domain controller replication rights (Replication-Get-Changes or Replication-Get-Changes-All). This behavior is often associated with credential dumping techniques like DCSync, where an attacker impersonates a domain controller to request replication of sensitive data, such as password hashes, from another domain controller.
Detects attempts to dump credentials using 'reg save HKLM\SAM' command or the 'impacket-secretsdump' tool. These methods are commonly used by adversaries to extract password hashes from the Security Account Manager (SAM) database or other credential stores for offline cracking or reuse.
Detects attempts to extract the Active Directory database (NTDS.dit) by monitoring for the execution of administrative tools (vssadmin, diskshadow, ntdsutil, esentutl) with command-line arguments indicative of file copying, shadow copy creation, or database manipulation.
Detects techniques used to extract the Active Directory database (NTDS.dit) for credential dumping. This includes the use of native Windows utilities like ntdsutil.exe, vssadmin.exe, and diskshadow.exe to create volume shadow copies, as well as the identification of ntds.dit files being created or accessed in non-standard locations.
Detects common credential dumping techniques targeting the LSASS process or NTDS.dit database, including the use of known dump utilities such as Procdump, Rundll32 with comsvcs.dll, and Ntdsutil, as well as unauthorized process access to LSASS.
Hunting rule: correlate with additional signals before alerting.
Detects vssadmin shadow copy creation commonly preceding NTDS or SAM extraction.
Detects vssadmin shadow copy creation commonly preceding NTDS or SAM extraction.
Detects the specific syntax used by the threat actor to abuse vssadmin or ntdsutil for extracting the Active Directory database from shadow copies.
correlate with additional signals before alerting.
Detects wmic shadowcopy create used to stage credential database extraction.
Detects wmic shadowcopy create used to stage credential database extraction.
Detects the execution of tools writing Active Directory database components (ntds.dit, SAM, SYSTEM, SECURITY) directly into user download directories. This activity is indicative of credential harvesting, specifically targeting Active Directory database files.
Identifies explicit attempts to parse or dump the Active Directory database using ntdsutil.exe IFM creation parameters.
correlate with additional signals before alerting.
Detects wmic shadowcopy create used to stage credential database extraction.
Detects wmic shadowcopy create used to stage credential database extraction.
This rule detects the execution of processes where the command line contains keywords commonly associated with credential dumping activities, specifically targeting NTUser.dat, SAM, or SYSTEM files. These files often contain sensitive credential information that attackers attempt to extract.
This rule detects attempts to access the NTDS.dit file or the SYSTEM registry hive, indicated by Security Event ID 4656. Multiple access attempts within an hour are summarized by the subject user name.
This rule detects attempts to copy the NTDS.dit Active Directory database file over SMB (Server Message Block) to a server. The rule specifically looks for the string "ntds.dit" within TCP traffic destined for port 445 (SMB). This activity is highly suspicious as the NTDS.dit file contains critical Active Directory information, including hashed user credentials, and its exfiltration is a common technique used by attackers for credential dumping.
This rule detects attempts to dump NTDS.dit via the Volume Shadow Copy technique over HTTP. It specifically looks for HTTP URIs containing both 'vssadmin' and 'ntds.dit' (case-insensitive). This combination suggests an attacker is trying to exfiltrate the NTDS.dit file, which contains Active Directory database information, using the vssadmin utility to create a shadow copy and then access the file.
Page 7 of 14