Suspicious Access to Active Directory Database File

[rule]
description = """
Identifies access to the Active Directory Domain Database file (ntds.dit). This file contains sensitive information
including hashed domain credentials.
"""
id = "d66765b8-010b-4a40-ab62-1d8f13a44878"
license = "Elastic License v2"
name = "Suspicious Access to Active Directory Database File"
os_list = ["windows"]
reference = [
    "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration",
]
version = "1.0.35"

query = '''
file where event.action == "open" and process.pid != 4 and 
 file.path : "*\\Windows\\NTDS\\ntds.dit" and process.executable : "?:\\*" and
 /* covered by RuleId 3c44fc50-2672-48b3-af77-ff43b895ac70 */
 not process.executable :
             ("?:\\Windows\\System32\\ntdsutil.exe",
              "?:\\Windows\\System32\\esentutl.exe",
              "?:\\Windows\\system32\\lsass.exe",
              "?:\\Windows\\System32\\wbengine.exe",
              "?:\\Program Files\\*.exe",
              "?:\\Program Files (x86)\\*.exe",
              "C:\\PCBP\\WBPS.exe",
              "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*.exe", 
              "?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*.exe",
              "?:\\Windows\\explorer.exe") and
 not (process.code_signature.subject_name in ("EFOLDER, INC.", "Avira Operations GmbH") and process.code_signature.trusted == true)
'''

min_endpoint_version = "8.1.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.003"
name = "NTDS"
reference = "https://attack.mitre.org/techniques/T1003/003/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.1.0"