Detectionmediumtest

Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)

Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Wed Sep 14a58353df-af43-4753-bad0-cd83ef35eef5windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|endswith: '\ntdsutil.exe'
        - OriginalFileName: 'ntdsutil.exe'
    selection_cli:
        - CommandLine|contains|all:
              - 'snapshot'
              - 'mount ' # mounts a specific snapshot - Ex: ntdsutil snapshot "mount c2b3e2c6-1ffb-4625-ba8e-3503c27a9fcb" quit quit
        - CommandLine|contains|all:
              # This offers more coverage to the "selection_oneliner_1" case in rule 8bc64091-6875-4881-aaf9-7bd25b5dda08
              # The shorest form of "activate" can "ac". But "act", "acti"...etc are also valid forms
              # Same case with the "instance" flag
              - 'ac'
              - ' i'
              - ' ntds'
    condition: all of selection_*