rules/windows/process_creation/win_susp_ntdsutil.yml

title: Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)
id: 2afafd61-6aae-4df4-baed-139fa1f4c345
description: Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)
status: experimental
references:
    - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/ntdsutil.htm
author: Thomas Patzke
tags:
    - attack.credential_access
    - attack.t1003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine: '*\ntdsutil*'
    condition: selection
falsepositives:
    - NTDS maintenance
level: high
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`title: Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 2afafd61-6aae-4df4-baed-139fa1f4c345`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`description: Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)`
			`status: experimental`
			`references:`
Increased indentation to 4 2019-03-02 00:14:20 +01:00			`- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/ntdsutil.htm`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`author: Thomas Patzke`
			`tags:`
Increased indentation to 4 2019-03-02 00:14:20 +01:00			`- attack.credential_access`
			`- attack.t1003`
Merge branch 'master' into project-1 2019-02-26 00:24:46 +01:00			`logsource:`
Increased indentation to 4 2019-03-02 00:14:20 +01:00			`category: process_creation`
			`product: windows`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`detection:`
Increased indentation to 4 2019-03-02 00:14:20 +01:00			`selection:`
			`CommandLine: '\ntdsutil'`
			`condition: selection`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`falsepositives:`
Increased indentation to 4 2019-03-02 00:14:20 +01:00			`- NTDS maintenance`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`level: high`