NTDS Dump via Wbadmin

 1[metadata]
 2creation_date = "2024/06/05"
 3integration = ["windows", "endpoint", "system"]
 4maturity = "production"
 5updated_date = "2024/08/07"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies the execution of wbadmin to access the NTDS.dit file in a domain controller. Attackers with privileges from
11groups like Backup Operators can abuse the utility to perform credential access and compromise the domain.
12"""
13from = "now-9m"
14index = [
15    "winlogbeat-*",
16    "logs-endpoint.events.process-*",
17    "logs-windows.*",
18    "endgame-*",
19    "logs-system.security*",
20]
21language = "eql"
22license = "Elastic License v2"
23name = "NTDS Dump via Wbadmin"
24references = [
25    "https://medium.com/r3d-buck3t/windows-privesc-with-sebackupprivilege-65d2cd1eb960"
26]
27risk_score = 47
28rule_id = "d93e61db-82d6-4095-99aa-714988118064"
29severity = "medium"
30tags = [
31    "Domain: Endpoint",
32    "OS: Windows",
33    "Use Case: Threat Detection",
34    "Tactic: Credential Access",
35    "Data Source: Elastic Endgame",
36    "Data Source: Elastic Defend",
37    "Data Source: System",
38]
39timestamp_override = "event.ingested"
40type = "eql"
41
42query = '''
43process where host.os.type == "windows" and event.type == "start" and
44    (process.name : "wbadmin.exe" or ?process.pe.original_file_name : "wbadmin.exe") and 
45     process.args : "recovery" and process.command_line : "*ntds.dit*"
46'''
47
48
49[[rule.threat]]
50framework = "MITRE ATT&CK"
51[[rule.threat.technique]]
52id = "T1003"
53name = "OS Credential Dumping"
54reference = "https://attack.mitre.org/techniques/T1003/"
55[[rule.threat.technique.subtechnique]]
56id = "T1003.002"
57name = "Security Account Manager"
58reference = "https://attack.mitre.org/techniques/T1003/002/"
59
60[[rule.threat.technique.subtechnique]]
61id = "T1003.003"
62name = "NTDS"
63reference = "https://attack.mitre.org/techniques/T1003/003/"
64
65
66
67[rule.threat.tactic]
68id = "TA0006"
69name = "Credential Access"
70reference = "https://attack.mitre.org/tactics/TA0006/"
71
72
73[[rule.threat]]
74framework = "MITRE ATT&CK"
75[[rule.threat.technique]]
76id = "T1006"
77name = "Direct Volume Access"
78reference = "https://attack.mitre.org/techniques/T1006/"
79
80
81[rule.threat.tactic]
82id = "TA0005"
83name = "Defense Evasion"
84reference = "https://attack.mitre.org/tactics/TA0005/"