ntds.dit Command Line (PowerShell)

id: '20543.36412'
title: ntds.dit Command Line
description: 'Adversaries may attempt to access or create a copy of the Active Directory
  domain database in order to steal credential information, as well as obtain other
  information about domain members such as devices, users, and access rights. This
  use case specifically looks for command line argument executions with ntds.dit.
  -- Threat Actor Association: Mustang Panda (aka. Stately Taurus//Earth Preta/BRONZE
  PRESIDENT/TA416/RedDelta), Volt Typhoon - Software Association: Akira -- Atomics
  T1003.003 Test #2 Atomics T1003.003 Test #3 Atomics T1003.003 Test #6'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") "ntds.dit" | regex
  process="(?i)ntds\.dit" | table _time, host, user process, process_name, signature_id,
  process_msg | bin span=1s | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
technique_id:
- T1003.003
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration