Detection rules › By catalog entry

ESENT

Catalog entry	Rules
Event ID 216	2
Event ID 325	4
Event ID 326	3
Event ID 327	3

Event ID 216

2 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Ntdsutil Abuse severity medium T1003,T1003.003

YARA-L (1)

MITRE ATT&CK T1003.003 WMIC Ntds.dit CISA Report severity high T1003,T1003.003

Event ID 325

4 detection rules reference this catalog entry. View catalog entry.

Sigma (3)

Dump Ntds.dit To Suspicious Location severity medium
IFM detected - ESENT (installation from media) severity high T1003,T1003.003
Ntdsutil Abuse severity medium T1003,T1003.003

YARA-L (1)

MITRE ATT&CK T1003.003 WMIC Ntds.dit CISA Report severity high T1003,T1003.003

Event ID 326

3 detection rules reference this catalog entry. View catalog entry.

Sigma (2)

IFM detected - ESENT (installation from media) severity high T1003,T1003.003
Ntdsutil Abuse severity medium T1003,T1003.003

YARA-L (1)

MITRE ATT&CK T1003.003 WMIC Ntds.dit CISA Report severity high T1003,T1003.003

Event ID 327

3 detection rules reference this catalog entry. View catalog entry.

Sigma (2)

IFM detected - ESENT (installation from media) severity high T1003,T1003.003
Ntdsutil Abuse severity medium T1003,T1003.003

YARA-L (1)

MITRE ATT&CK T1003.003 WMIC Ntds.dit CISA Report severity high T1003,T1003.003

Back to all ESENT catalog entries