rules/windows/process_creation/proc_creation_win_ntdsutil_usage.yml

title: Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)
id: 2afafd61-6aae-4df4-baed-139fa1f4c345
status: test
description: Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)
references:
    - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/ntdsutil.htm
author: Thomas Patzke
date: 2019-01-16
modified: 2022-03-11
tags:
    - attack.credential-access
    - attack.t1003.003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\ntdsutil.exe'
    condition: selection
falsepositives:
    - NTDS maintenance
level: medium
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`title: Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 2afafd61-6aae-4df4-baed-139fa1f4c345`
$frack113$ Change status to test 2022-01-07 07:04:24 +01:00			`status: test`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`description: Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)`
$frack113$ Change status to test 2022-01-07 07:04:24 +01:00			`references:`
Updates 2022-09-14 12:29:57 +02:00			`- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/ntdsutil.htm`
$frack113$ order yaml 2022-10-28 15:06:36 +02:00			`author: Thomas Patzke`
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes 2024-08-12 12:02:50 +02:00			`date: 2019-01-16`
			`modified: 2022-03-11`
$frack113$ order yaml 2022-10-28 15:06:36 +02:00			`tags:`
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes 2024-08-12 12:02:50 +02:00			`- attack.credential-access`
$frack113$ order yaml 2022-10-28 15:06:36 +02:00			`- attack.t1003.003`
Merge branch 'master' into project-1 2019-02-26 00:24:46 +01:00			`logsource:`
Updates 2022-09-14 12:29:57 +02:00			`category: process_creation`
			`product: windows`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`detection:`
Updates 2022-09-14 12:29:57 +02:00			`selection:`
			`Image\|endswith: '\ntdsutil.exe'`
			`condition: selection`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 23:36:31 +01:00			`falsepositives:`
Updates 2022-09-14 12:29:57 +02:00			`- NTDS maintenance`
docs: adjustments 2022-03-11 18:13:54 +01:00			`level: medium`