EXPLORE
Sign In
← Back to Explore
sigmamediumHunting

Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)

Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.

MITRE ATT&CK

T1003.003
credential-access

Detection Query

selection_img:
  - Image|endswith: \ntdsutil.exe
  - OriginalFileName: ntdsutil.exe
selection_cli:
  - CommandLine|contains|all:
      - snapshot
      - "mount "
  - CommandLine|contains|all:
      - ac
      - " i"
      - " ntds"
condition: all of selection_*

Author

Nasreddine Bencherchali (Nextron Systems)

Created

2022-09-14

Data Sources

windowsProcess Creation Events

Platforms

windows

References

Tags

attack.credential-accessattack.t1003.003
Raw Content
title: Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)
id: a58353df-af43-4753-bad0-cd83ef35eef5
related:
    - id: 2afafd61-6aae-4df4-baed-139fa1f4c345
      type: derived
status: test
description: Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731620(v=ws.11)
    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-09-14
tags:
    - attack.credential-access
    - attack.t1003.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\ntdsutil.exe'
        - OriginalFileName: 'ntdsutil.exe'
    selection_cli:
        - CommandLine|contains|all:
              - 'snapshot'
              - 'mount ' # mounts a specific snapshot - Ex: ntdsutil snapshot "mount c2b3e2c6-1ffb-4625-ba8e-3503c27a9fcb" quit quit
        - CommandLine|contains|all:
              # This offers more coverage to the "selection_oneliner_1" case in rule 8bc64091-6875-4881-aaf9-7bd25b5dda08
              # The shorest form of "activate" can "ac". But "act", "acti"...etc are also valid forms
              # Same case with the "instance" flag
              - 'ac'
              - ' i'
              - ' ntds'
    condition: all of selection_*
falsepositives:
    - Legitimate usage to restore snapshots
    - Legitimate admin activity
level: medium