title: Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)
id: 2afafd61-6aae-4df4-baed-139fa1f4c345
status: test
description: Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)
author: Thomas Patzke
references:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/ntdsutil.htm
date: 2019/01/16
modified: 2022/03/11  # increased level
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\ntdsutil.exe'
  condition: selection
falsepositives:
  - NTDS maintenance
level: medium
tags:
  - attack.credential_access
  - attack.t1003.003
