IFM creation detected from commandline (installation from media)

title: IFM creation detected from commandline (installation from media)
description: Detects scenarios where an attacker attempts to create an IFM image (usually used for deploying domain controllers to reduce replication traffic) for dumping credentials.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1003-Credential%20dumping
- https://blog.menasec.net/2019/11/forensics-traces-of-ntdsdit-dumping.html
- https://adsecurity.org/?p=2398
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11)
- https://www.microsoft.com/security/blog/2021/11/08/threat-actor-dev-0322-exploiting-zoho-manageengine-adselfservice-plus/
- https://twitter.com/JohnLaTwC/status/1416382178380767233?s=09
- https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/
- https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html
- https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
- https://blog.sekoia.io/lucky-mouse-incident-response-to-detection-engineering/
- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
- https://medium.com/@simone.kraus/part-2-sensor-mapping-reverse-engineering-ntds-a73bde69031e
tags:
- attack.credential_dumping
- attack.t1003.003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection_baseline:
    NewProcessName|endswith: 
      - '\ntdsutil.exe'
      - '\dsdbutil.exe'

  selection_creation_basic: # full command: "ntdsutil "activate instance ntds" ifm "create full c:\data" quit quit"
    CommandLine|contains|all:
      - ifm
      - create

  selection_creation_obfuscated:
    CommandLine|contains|all:
      - ' i '  # ifm
      - ' c '  # create

  selection_activation_basic: # full command "ntdsutil.exe "act i ntds" i "c full c:\hacker" q q"
    CommandLine|contains|all:
      - activate
      - instance
      - ntds

  selection_activation_obfuscated:
    CommandLine|contains|all:
      - 'ac ' # activate
      - ntds

  condition: selection_baseline and 1 of selection_*
falsepositives:
- Administrator creating a IFM image
- Backup program or script
level: high