NTDS Dump via Wbadmin
Identifies the execution of wbadmin to access the NTDS.dit file in a domain controller. Attackers with privileges from groups like Backup Operators can abuse the utility to perform credential access and compromise the domain.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2024/06/05"
3integration = ["windows", "endpoint", "system"]
4maturity = "production"
5updated_date = "2024/08/07"
6
7[rule]
8author = ["Elastic"]
9description = """
10Identifies the execution of wbadmin to access the NTDS.dit file in a domain controller. Attackers with privileges from
11groups like Backup Operators can abuse the utility to perform credential access and compromise the domain.
12"""
13from = "now-9m"
14index = [
15 "winlogbeat-*",
16 "logs-endpoint.events.process-*",
17 "logs-windows.*",
18 "endgame-*",
19 "logs-system.security*",
20]
21language = "eql"
22license = "Elastic License v2"
23name = "NTDS Dump via Wbadmin"
24references = [
25 "https://medium.com/r3d-buck3t/windows-privesc-with-sebackupprivilege-65d2cd1eb960"
26]
27risk_score = 47
28rule_id = "d93e61db-82d6-4095-99aa-714988118064"
29severity = "medium"
30tags = [
31 "Domain: Endpoint",
32 "OS: Windows",
33 "Use Case: Threat Detection",
34 "Tactic: Credential Access",
35 "Data Source: Elastic Endgame",
36 "Data Source: Elastic Defend",
37 "Data Source: System",
38]
39timestamp_override = "event.ingested"
40type = "eql"
41
42query = '''
43process where host.os.type == "windows" and event.type == "start" and
44 (process.name : "wbadmin.exe" or ?process.pe.original_file_name : "wbadmin.exe") and
45 process.args : "recovery" and process.command_line : "*ntds.dit*"
46'''
47
48
49[[rule.threat]]
50framework = "MITRE ATT&CK"
51[[rule.threat.technique]]
52id = "T1003"
53name = "OS Credential Dumping"
54reference = "https://attack.mitre.org/techniques/T1003/"
55[[rule.threat.technique.subtechnique]]
56id = "T1003.002"
57name = "Security Account Manager"
58reference = "https://attack.mitre.org/techniques/T1003/002/"
59
60[[rule.threat.technique.subtechnique]]
61id = "T1003.003"
62name = "NTDS"
63reference = "https://attack.mitre.org/techniques/T1003/003/"
64
65
66
67[rule.threat.tactic]
68id = "TA0006"
69name = "Credential Access"
70reference = "https://attack.mitre.org/tactics/TA0006/"
71
72
73[[rule.threat]]
74framework = "MITRE ATT&CK"
75[[rule.threat.technique]]
76id = "T1006"
77name = "Direct Volume Access"
78reference = "https://attack.mitre.org/techniques/T1006/"
79
80
81[rule.threat.tactic]
82id = "TA0005"
83name = "Defense Evasion"
84reference = "https://attack.mitre.org/tactics/TA0005/"
References
Related rules
- Credential Acquisition via Registry Hive Dumping
- Microsoft IIS Connection Strings Decryption
- NTDS or SAM Database File Copied
- Potential Credential Access via Windows Utilities
- Potential Local NTLM Relay via HTTP