detection.wiki

Detection rules › Sigma

NTDS.DIT Creation By Uncommon Parent Process

Status
test
Severity
high
Log source
product windows, category file_event
Author
Florian Roth (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003.003 OS Credential Dumping: NTDS

Event coverage

ProviderEventTitle
SysmonEvent ID 11FileCreate

Rule body yaml

title: NTDS.DIT Creation By Uncommon Parent Process
id: 4e7050dd-e548-483f-b7d6-527ab4fa784d
related:
    - id: 11b1ed55-154d-4e82-8ad7-83739298f720
      type: similar
status: test
description: Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory
references:
    - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
    - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/
    - https://pentestlab.blog/tag/ntds-dit/
    - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1
author: Florian Roth (Nextron Systems)
date: 2022-03-11
modified: 2023-01-05
tags:
    - attack.credential-access
    - attack.t1003.003
logsource:
    product: windows
    category: file_event
    definition: 'Requirements: The "ParentImage" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enrich the log with additional ParentImage data'
detection:
    selection_file:
        TargetFilename|endswith: '\ntds.dit'
    selection_process_parent:
        # Note: ParentImage is a custom field and is not available by default on Sysmon EID 11
        ParentImage|endswith:
            - '\cscript.exe'
            - '\httpd.exe'
            - '\nginx.exe'
            - '\php-cgi.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\w3wp.exe'
            - '\wscript.exe'
    selection_process_parent_path:
        # Note: ParentImage is a custom field and is not available by default on Sysmon EID 11
        ParentImage|contains:
            - '\apache'
            - '\tomcat'
            - '\AppData\'
            - '\Temp\'
            - '\Public\'
            - '\PerfLogs\'
    condition: selection_file and 1 of selection_process_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection_file and 1 of selection_process_*

Stage 1: selection_file

selection_file:
    TargetFilename|endswith: '\ntds.dit'

Stage 2: selection_process_parent

selection_process_parent:
    ParentImage|endswith:
        - '\cscript.exe'
        - '\httpd.exe'
        - '\nginx.exe'
        - '\php-cgi.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\w3wp.exe'
        - '\wscript.exe'

Stage 3: selection_process_parent_path

selection_process_parent_path:
    ParentImage|contains:
        - '\apache'
        - '\tomcat'
        - '\AppData\'
        - '\Temp\'
        - '\Public\'
        - '\PerfLogs\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ParentImageends_with
  • \cscript.exe corpus 17 (sigma 17)
  • \httpd.exe corpus 6 (sigma 6)
  • \nginx.exe corpus 6 (sigma 6)
  • \php-cgi.exe corpus 6 (sigma 6)
  • \powershell.exe corpus 24 (sigma 24)
  • \pwsh.exe corpus 21 (sigma 21)
  • \w3wp.exe corpus 12 (sigma 12)
  • \wscript.exe corpus 19 (sigma 19)
ParentImagematch
  • \AppData\ corpus 3 (sigma 3)
  • \PerfLogs\ corpus 2 (sigma 2)
  • \Public\ corpus 2 (sigma 2)
  • \Temp\ corpus 3 (sigma 3)
  • \apache corpus 2 (sigma 2)
  • \tomcat corpus 6 (sigma 6)
TargetFilenameends_with
  • \ntds.dit corpus 2 (sigma 2)