OS Credential Dumping: NTDS T1003.003
Tactic: Credential Access
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\NTDS\Ntds.dit of a domain controller.
Events covered
12 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 11 | FileCreate |
| Security-Auditing | Event ID 4648 | A logon was attempted using explicit credentials. |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Security-Auditing | Event ID 5145 | A network share object was checked to see whether client can be granted desired access. |
| ESENT | Event ID 216 | Event ID 216 |
| ESENT | Event ID 325 | Event ID 325 |
| ESENT | Event ID 326 | Event ID 326 |
| ESENT | Event ID 327 | Event ID 327 |
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
| VSSAudit | Event ID 8222 | Event ID 8222 |
Authoring guide
Patterns shared across the 58 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (25 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (266 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.
Exclusions (3 distinct)
Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 26 rules
- Copying Sensitive Files with Credential Data
- Create Volume Shadow Copy with Powershell
- Cred Dump Tools Dropped Files
- Esentutl Gather Credentials
- IFM creation detected from commandline (installation from media)
- IFM detected - ESENT (installation from media)
- Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)
- NTDS Exfiltration Filename Patterns
- NTDS.DIT Created
- NTDS.DIT Creation By Uncommon Parent Process
- NTDS.DIT Creation By Uncommon Process
- Ntdsutil Abuse
- Possible Impacket SecretDump Remote Activity
- Possible Impacket SecretDump Remote Activity - Zeek
- Potential Russian APT Credential Theft Activity
- PUA - DIT Snapshot Viewer
- Sensitive File Dump Via Print.EXE
- Sensitive File Dump Via Wbadmin.EXE
- Sensitive File Recovery From Backup Via Wbadmin.EXE
- Shadow Copies Creation Using Operating Systems Utilities
- Suspicious Get-ADDBAccount Usage
- Suspicious Process Patterns NTDS.DIT Exfil
- Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)
- Transferring Files with Credential Data via Network Shares
- Transferring Files with Credential Data via Network Shares - Zeek
- VolumeShadowCopy Symlink Creation Via Mklink
Elastic 6 rules
- Creation or Modification of Domain Backup DPAPI private key
- NTDS Dump via Wbadmin
- NTDS or SAM Database File Copied
- Potential Credential Access via Windows Utilities
- PowerShell Invoke-NinjaCopy script
- Symbolic Link to Shadow Copy Created
Splunk 24 rules
- ADExplorer Execution (Sysmon)
- ADExplorer Execution (Windows Event Log)
- ADExplorer Snapshot Creation (Sysmon)
- ADExplorer Snapshot Creation (Windows Event Log)
- Creation of Shadow Copy
- Creation of Shadow Copy with wmic and powershell
- Credential Dumping via Copy Command from Shadow Copy
- Credential Dumping via Symlink to Shadow Copy
- Esentutl Execution (PowerShell)
- Esentutl Execution (Sysmon)
- Esentutl Execution (Windows Event Log)
- ntds.dit Access from Unexpected Location (Sysmon)
- ntds.dit Access from Unexpected Location (Windows Event Log)
- ntds.dit Command Line (PowerShell)
- ntds.dit Command Line (Sysmon)
- ntds.dit Command Line (Windows Event Log)
- Ntdsutil Export NTDS
- NTDSUtil.exe execution (Sysmon)
- NTDSUtil.exe execution (Windows Event Log)
- SecretDumps Offline NTDS Dumping Tool
- Shadow Copy Created (Windows Event Log)
- Suspicious ntds.dit Commands (PowerShell)
- Suspicious ntds.dit Commands (Sysmon)
- Suspicious ntds.dit Commands (Windows Event Log)