detection.wiki

Detection rules › Sigma

IFM detected - ESENT (installation from media)

Status
experimental
Severity
high
Log source
product windows, service application
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to create an IFM image (usually used for deploying domain controllers to reduce replication traffic) for dumping credentials.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003.003 OS Credential Dumping: NTDS

Event coverage

ProviderEvent
ESENTEvent ID 325
ESENTEvent ID 326
ESENTEvent ID 327

Rule body yaml

title: IFM detected - ESENT (installation from media)
description: Detects scenarios where an attacker attempts to create an IFM image (usually used for deploying domain controllers to reduce replication traffic) for dumping credentials.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1003-Credential%20dumping
- https://adsecurity.org/?p=2398
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
tags:
- attack.credential_dumping
- attack.t1003.003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: application # provider: ESENT
detection:
  selection:
    EventID:
      - 325 # The database engine created a new database
      - 326 # The database engine attached a new database
      - 327 # The database engine detached a database
    EventData|contains:
      - '\ntds.dit'
  filter:
      - '<normal backup path>'
  condition: selection and not filter
falsepositives:
- Administrator creating a IFM image
- Backup program or script
level: high

Stages and Predicates

Stage 0: condition

selection and not filter

Stage 1: selection

selection:
  EventID:
    - 325
    - 326
    - 327
  EventData|contains:
    - '\ntds.dit'

Stage 2: not filter

filter:
    - '<normal backup path>'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventDatamatch
  • \ntds.dit