IFM detected - ESENT (installation from media)

Status: experimental
Severity: high
Log source: product windows, service application
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to create an IFM image (usually used for deploying domain controllers to reduce replication traffic) for dumping credentials.

Known false positives

Administrator creating a IFM image
Backup program or script

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.003` OS Credential Dumping: NTDS

Telemetry coverage

Provider	Record / event type
ESENT	Event ID 325
ESENT	Event ID 326
ESENT	Event ID 327

Rule body

title: IFM detected - ESENT (installation from media)
description: Detects scenarios where an attacker attempts to create an IFM image (usually used for deploying domain controllers to reduce replication traffic) for dumping credentials.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1003-Credential%20dumping
- https://adsecurity.org/?p=2398
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
tags:
- attack.credential_dumping
- attack.t1003.003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: application # provider: ESENT
detection:
  selection:
    EventID:
      - 325 # The database engine created a new database
      - 326 # The database engine attached a new database
      - 327 # The database engine detached a database
    EventData|contains:
      - '\ntds.dit'
  filter:
      - '<normal backup path>'
  condition: selection and not filter
falsepositives:
- Administrator creating a IFM image
- Backup program or script
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
  EventID:
    - 325
    - 326
    - 327
  EventData|contains:
    - '\ntds.dit'

Stage 2: `not filter`

filter:
    - '<normal backup path>'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventData`	match	`\ntds.dit`	`field:"EventData" kind:match value:"\ntds.dit"`