NTDSUtil.exe execution (Sysmon)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

ntdsutil.exe is a native Windows command line utility used to export Active Directory. Adversaries can utilize ntdsutil to potential dump credentials from files like ntds.dit

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.003` OS Credential Dumping: NTDS

References

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

id: '6589.18040'
title: NTDSUtil.exe execution
description: 'ntdsutil.exe is a native Windows command line utility used to export
  Active Directory. Adversaries can utilize ntdsutil to potential dump credentials
  from files like ntds.dit. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
  Threat Actor Association: APT29/Nobelium/Cozy Bear, CL-STA-0043, FIN6, FIN12, Lapsus$,
  TA428, Trickbot, Vice Society, Volt Typhoon, Wizard Spider Software Association:
  ALPHV/BlackCat, Bazar, BianLian, Conti, Hafnium, Lockbit, Prestige, Vice Society
  -- Atomics T1003.003 Test #3 -- #TrendingThreat #Russia #Ukraine'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "ntdsutil" | table _time, host, user user, process, process_*, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- credential-access:os credential dumping:ntds
- credential-access:os credential dumping
technique_id:
- T1003.003
- T1003
data_category:
- Windows Sysmon
references:
- https://adsecurity.org/?p=2398#CreateIFM
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Ntdsutil/#dump

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") "ntdsutil"

Stage 2: `table`

| table _time, host, user user, process, process_*, parent_*

Stage 3: `bucket`

| bin span=1s

Stage 4: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`1` corpus 241 (splunk 225, kusto 15, elastic 1)	`field:"EventID" kind:eq value:"1"`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>1<"`
1	`"ntdsutil"`