NTDS or SAM Database File Copied

  1[metadata]
  2creation_date = "2020/11/24"
  3integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic", "Austin Songer"]
  9description = """
 10Identifies a copy operation of the Active Directory Domain Database (ntds.dit) or Security Account Manager (SAM) files.
 11Those files contain sensitive information including hashed domain and/or local credentials.
 12"""
 13from = "now-9m"
 14index = [
 15    "endgame-*",
 16    "logs-crowdstrike.fdr*",
 17    "logs-endpoint.events.process-*",
 18    "logs-m365_defender.event-*",
 19    "logs-sentinel_one_cloud_funnel.*",
 20    "logs-system.security*",
 21    "logs-windows.forwarded*",
 22    "logs-windows.sysmon_operational-*",
 23    "winlogbeat-*",
 24]
 25language = "eql"
 26license = "Elastic License v2"
 27max_signals = 33
 28name = "NTDS or SAM Database File Copied"
 29references = [
 30    "https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/",
 31    "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy",
 32    "https://www.elastic.co/security-labs/detect-credential-access",
 33    "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry",
 34]
 35risk_score = 73
 36rule_id = "3bc6deaa-fbd4-433a-ae21-3e892f95624f"
 37severity = "high"
 38tags = [
 39    "Domain: Endpoint",
 40    "OS: Windows",
 41    "Use Case: Threat Detection",
 42    "Tactic: Credential Access",
 43    "Data Source: Elastic Endgame",
 44    "Data Source: Elastic Defend",
 45    "Data Source: Windows Security Event Logs",
 46    "Data Source: Microsoft Defender XDR",
 47    "Data Source: SentinelOne",
 48    "Data Source: Sysmon",
 49    "Data Source: Crowdstrike",
 50    "Resources: Investigation Guide",
 51    "Noise: Medium",
 52    "Performance: Normal",
 53    "Profile: Recommended",
 54    "Threat: Ransomware",
 55    "Rule Type: Event Correlation (EQL)",
 56    "Platform: Windows",
 57]
 58timestamp_override = "event.ingested"
 59type = "eql"
 60
 61query = '''
 62process where host.os.type == "windows" and event.type == "start" and
 63  (
 64    ((?process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE", "XCOPY.EXE") or process.name : ("Cmd.Exe", "PowerShell.EXE", "XCOPY.EXE")) and
 65       process.args : ("copy", "xcopy", "Copy-Item", "move", "cp", "mv")
 66    ) or
 67    ((?process.pe.original_file_name : "esentutl.exe" or process.name : "esentutl.exe") and process.args : ("*/y*", "*/vss*", "*/d*"))
 68  ) and
 69  process.command_line : ("*\\ntds.dit*", "*\\config\\SAM*", "*\\*\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\*", "*/system32/config/SAM*")
 70'''
 71
 72note = """## Triage and analysis
 73
 74### Investigating NTDS or SAM Database File Copied
 75
 76#### Possible investigation steps
 77
 78- What protected store did the alerting command try to copy, and where was it sent?
 79  - Focus: `process.command_line` for NTDS vs SAM, direct path vs "GLOBALROOT\\Device\\HarddiskVolumeShadowCopy" or "esentutl.exe /y /vss /d", and a local, UNC, archive, or temp-like destination.
 80  - Implication: escalate when the command copies NTDS, SAM, or a VSS-backed hive to a user-writable, remote, or archive path, and treat NTDS as domain credential exposure and SAM as local credential exposure; lower suspicion only when the exact source, destination, and copy method fit one recognized backup, repair, or authorized forensic collection. Identity alone never clears the copy.
 81
 82- If PowerShell performed the copy, what script content produced it?
 83  - Focus: if PowerShell script-block telemetry is available, recover events with `host.id` + `process.pid` in a tight alert window; reconstruct split blocks with `powershell.file.script_block_id`, `powershell.sequence`, and `powershell.total`, then read `powershell.file.script_block_text`. Missing PowerShell telemetry is unresolved, not benign.
 84  - Implication: escalate when the reconstructed script copies NTDS, SAM, or VSS paths, loops shadow copies, hides destinations, or chains archive or transfer logic; lower suspicion when script content matches the same recognized backup, repair, or forensic workflow as the alert command.
 85
 86- Is the copier the expected binary in the expected launch chain?
 87  - Focus: `process.executable`, `process.pe.original_file_name`, `process.code_signature.subject_name`, `process.code_signature.trusted`, and `process.parent.executable`.
 88  - Implication: escalate when the copier is renamed, unsigned or unexpectedly signed, runs from a user-writable path, or is launched by an unusual shell, script, service, or remote tool; lower suspicion when the same binary identity and parent chain match the workflow proven in the command line.
 89
 90- Does the user, privilege, and session context fit protected credential-store access?
 91  - Focus: `user.id`, `process.Ext.session_info.logon_type`, `process.Ext.token.integrity_level_name`, and `process.Ext.authentication_id`. $investigate_2
 92  - Hint: if Windows Security authentication logs are available, recover session origin by matching `process.Ext.authentication_id` to same-host `winlog.event_data.TargetLogonId`, then read `source.ip` and `winlog.event_data.AuthenticationPackageName`. Missing authentication telemetry is unresolved, not benign.
 93  - Implication: escalate when the copy runs under an unexpected admin, service, machine, remote-interactive, or high-integrity context, or when recovered origin evidence conflicts with the same backup, repair, or forensic pattern; lower suspicion only when account, session type, and origin all match that pattern.
 94
 95- Do recovered artifacts or follow-on activity show staging or transfer?
 96  - Focus: if endpoint file telemetry is available, recover file events for the copier and children; read `file.path` and `file.name`. Missing file telemetry is unresolved, not benign. $investigate_3
 97  - Hint: review child starts where `process.parent.entity_id` matches the copier, especially `process.command_line` and `process.executable`; if endpoint network telemetry is available, recover connections for the copier and children, then read `destination.ip`, `destination.port`, and `network.direction`. Missing network telemetry is unresolved, not benign. $investigate_4 $investigate_5
 98  - Implication: escalate when copied hives, "ntds.dit", SAM exports, archives, child archivers, share-copy tools, upload utilities, or outbound connections reuse the copied store or destination; absence of recovered artifacts or connections cannot close the alert by itself.
 99
100- If local evidence is unrecognized, is this copy part of a VSS-to-archive credential-access chain?
101  - Focus: related alerts for `user.id` showing shadow-copy creation, credential dumping, archiving, privilege escalation, lateral movement, or the same command/store pattern. $investigate_0
102  - Hint: compare `host.id` history for the same store or destination pattern; this rule catches the copy, so earlier shadow-copy or backup-service activity changes scope. $investigate_1
103  - Implication: broaden scope when related evidence shows shadow-copy creation before the copy or archiving/transfer after it; do not close while the current copy evidence remains unresolved.
104
105- Escalate on an unrecognized NTDS, SAM, or VSS copy to a staging path, abnormal copier or parent, mismatched session, recovered script/artifact/transfer evidence, or a VSS-to-archive chain; close only when source, destination, copier, session, and recovered evidence all match one backup, repair, or authorized forensic/IR pattern; preserve and escalate when evidence is mixed or incomplete.
106
107### False positive analysis
108
109- Backup, disaster-recovery, repair, and authorized forensic/IR collection can legitimately copy NTDS, SAM, or VSS-backed hives. Confirm by aligning identity (`process.executable`, `process.code_signature.subject_name`, `process.parent.executable`), intent (bounded `process.command_line` source/destination), and scope (`user.id`, `host.id`, recovered artifact destination, and recovered session origin). If organizational records are unavailable, close only when telemetry proves the same identity, command, destination, artifact, session, `user.id`, and `host.id` pattern; otherwise preserve and escalate.
110- Build exceptions only from the minimum confirmed workflow pattern: stable `process.executable` or `process.code_signature.subject_name`, `process.parent.executable`, bounded `process.command_line` source/destination, `user.id`, and `host.id`. Avoid exceptions on utility name, copied store name, or destination family alone.
111
112### Response and remediation
113
114- If confirmed benign, reverse temporary containment and document the evidence that proved the workflow: copier identity, parent chain, command source/destination, recovered artifact destination, `user.id`, `host.id`, and recovered session origin. Create an exception only after a tuning review confirms the same stable workflow pattern; do not suppress on one partial match.
115- If suspicious but unconfirmed, preserve the alert, Timeline or query results, `process.entity_id` or `process.pid` + `host.id` + alert time, `process.command_line`, `process.parent.executable`, recovered copied-store paths, archive names, destination shares, transfer destinations, and recovered session-origin evidence before containment or cleanup.
116- Apply reversible containment next: restrict the destination share, block confirmed transfer destinations, heighten monitoring for the affected `host.id` and `user.id`, or isolate the endpoint only after weighing tier-0 and production impact.
117- If malicious activity is confirmed, isolate the host or contain the account according to the evidence, then terminate the copy, archive, or transfer process only after preserving `process.entity_id`, `process.parent.entity_id`, command lines, copied-store locations, and destination indicators.
118- For confirmed NTDS copying, activate the Active Directory compromise response plan and begin credential hygiene for affected administrative tiers. For confirmed SAM copying, scope local-account and service-account exposure on the affected endpoint or server.
119- After evidence export and scoping, eradicate only copied databases or hives, archives, shadow-copy artifacts, and staging utilities identified during investigation, then remediate the privilege path or access vector that enabled the copy.
120"""
121
122setup = """## Setup
123
124This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
125
126Setup instructions: https://ela.st/install-elastic-defend
127
128### Additional data sources
129
130This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
131
132- [CrowdStrike](https://ela.st/crowdstrike-integration)
133- [Microsoft Defender XDR](https://ela.st/m365-defender)
134- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
135- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
136- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
137"""
138
139[rule.investigation_fields]
140field_names = [
141    "@timestamp",
142    "host.id",
143    "user.name",
144    "user.id",
145    "process.entity_id",
146    "process.executable",
147    "process.command_line",
148    "process.pe.original_file_name",
149    "process.parent.entity_id",
150    "process.parent.executable",
151    "process.parent.command_line",
152    "process.code_signature.subject_name",
153    "process.Ext.authentication_id",
154    "process.Ext.session_info.logon_type",
155    "process.Ext.token.integrity_level_name",
156]
157
158[[transform.investigate]]
159label = "Alerts associated with the user"
160description = ""
161providers = [
162  [
163    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
164    { excluded = false, field = "user.id", queryType = "phrase", value = "{{user.id}}", valueType = "string" }
165  ]
166]
167relativeFrom = "now-48h/h"
168relativeTo = "now"
169
170[[transform.investigate]]
171label = "Alerts associated with the host"
172description = ""
173providers = [
174  [
175    { excluded = false, field = "event.kind", queryType = "phrase", value = "signal", valueType = "string" },
176    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" }
177  ]
178]
179relativeFrom = "now-48h/h"
180relativeTo = "now"
181
182[[transform.investigate]]
183label = "Authentication events for the linked session"
184description = ""
185providers = [
186  [
187    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
188    { excluded = false, field = "winlog.event_data.TargetLogonId", queryType = "phrase", value = "{{process.Ext.authentication_id}}", valueType = "string" },
189    { excluded = false, field = "event.code", queryType = "phrase", value = "4624", valueType = "string" }
190  ]
191]
192relativeFrom = "now-48h/h"
193relativeTo = "now"
194
195[[transform.investigate]]
196label = "File activity for the alerting process and children"
197description = ""
198providers = [
199  [
200    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
201    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
202    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
203  ],
204  [
205    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
206    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
207    { excluded = false, field = "event.category", queryType = "phrase", value = "file", valueType = "string" }
208  ]
209]
210relativeFrom = "now-1h"
211relativeTo = "now"
212
213[[transform.investigate]]
214label = "Child processes of the copier"
215description = ""
216providers = [
217  [
218    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
219    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
220    { excluded = false, field = "event.category", queryType = "phrase", value = "process", valueType = "string" }
221  ]
222]
223relativeFrom = "now-1h"
224relativeTo = "now"
225
226[[transform.investigate]]
227label = "Network activity for the alerting process and children"
228description = ""
229providers = [
230  [
231    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
232    { excluded = false, field = "process.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
233    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" }
234  ],
235  [
236    { excluded = false, field = "host.id", queryType = "phrase", value = "{{host.id}}", valueType = "string" },
237    { excluded = false, field = "process.parent.entity_id", queryType = "phrase", value = "{{process.entity_id}}", valueType = "string" },
238    { excluded = false, field = "event.category", queryType = "phrase", value = "network", valueType = "string" }
239  ]
240]
241relativeFrom = "now-1h"
242relativeTo = "now"
243
244[[rule.threat]]
245framework = "MITRE ATT&CK"
246[[rule.threat.technique]]
247id = "T1003"
248name = "OS Credential Dumping"
249reference = "https://attack.mitre.org/techniques/T1003/"
250[[rule.threat.technique.subtechnique]]
251id = "T1003.002"
252name = "Security Account Manager"
253reference = "https://attack.mitre.org/techniques/T1003/002/"
254
255[[rule.threat.technique.subtechnique]]
256id = "T1003.003"
257name = "NTDS"
258reference = "https://attack.mitre.org/techniques/T1003/003/"
259
260[rule.threat.tactic]
261id = "TA0006"
262name = "Credential Access"
263reference = "https://attack.mitre.org/tactics/TA0006/"