detection.wiki

Detection rules › Sigma

NTDS.DIT Creation By Uncommon Parent Process

Status
test
Severity
high
Log source
category file_event, product windows
Author
Florian Roth (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory

MITRE ATT&CK coverage

TacticTechniques
Credential Access

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 11: FileCreate

Rule body

title: NTDS.DIT Creation By Uncommon Parent Process
id: 4e7050dd-e548-483f-b7d6-527ab4fa784d
related:
    - id: 11b1ed55-154d-4e82-8ad7-83739298f720
      type: similar
status: test
description: Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory
references:
    - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
    - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/
    - https://pentestlab.blog/tag/ntds-dit/
    - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1
author: Florian Roth (Nextron Systems)
date: 2022-03-11
modified: 2023-01-05
tags:
    - attack.credential-access
    - attack.t1003.003
logsource:
    product: windows
    category: file_event
    definition: 'Requirements: The "ParentImage" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enrich the log with additional ParentImage data'
detection:
    selection_file:
        TargetFilename|endswith: '\ntds.dit'
    selection_process_parent:
        # Note: ParentImage is a custom field and is not available by default on Sysmon EID 11
        ParentImage|endswith:
            - '\cscript.exe'
            - '\httpd.exe'
            - '\nginx.exe'
            - '\php-cgi.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\w3wp.exe'
            - '\wscript.exe'
    selection_process_parent_path:
        # Note: ParentImage is a custom field and is not available by default on Sysmon EID 11
        ParentImage|contains:
            - '\apache'
            - '\tomcat'
            - '\AppData\'
            - '\Temp\'
            - '\Public\'
            - '\PerfLogs\'
    condition: selection_file and 1 of selection_process_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection_file and 1 of selection_process_*

Stage 1: selection_file

selection_file:
    TargetFilename|endswith: '\ntds.dit'

Stage 2: selection_process_parent

selection_process_parent:
    ParentImage|endswith:
        - '\cscript.exe'
        - '\httpd.exe'
        - '\nginx.exe'
        - '\php-cgi.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\w3wp.exe'
        - '\wscript.exe'

Stage 3: selection_process_parent_path

selection_process_parent_path:
    ParentImage|contains:
        - '\apache'
        - '\tomcat'
        - '\AppData\'
        - '\Temp\'
        - '\Public\'
        - '\PerfLogs\'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
ParentImageends_with
  • \cscript.exe corpus 17 (sigma 17)
  • \httpd.exe corpus 6 (sigma 6)
  • \nginx.exe corpus 6 (sigma 6)
  • \php-cgi.exe corpus 6 (sigma 6)
  • \powershell.exe corpus 24 (sigma 24)
  • \pwsh.exe corpus 21 (sigma 21)
  • \w3wp.exe corpus 12 (sigma 12)
  • \wscript.exe corpus 19 (sigma 19)
field:"ParentImage" kind:ends_with
ParentImagematch
  • \AppData\ corpus 3 (sigma 3)
  • \PerfLogs\ corpus 2 (sigma 2)
  • \Public\ corpus 2 (sigma 2)
  • \Temp\ corpus 3 (sigma 3)
  • \apache corpus 2 (sigma 2)
  • \tomcat corpus 6 (sigma 6)
field:"ParentImage" kind:match
TargetFilenameends_with
  • \ntds.dit corpus 2 (sigma 2)
field:"TargetFilename" kind:ends_with value:"\ntds.dit"