attack.t1003.003

Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.

Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·

Share on:

Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)

NTDS Exfiltration Filename Patterns

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·

Share on:

Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration.

NTDS.DIT Created

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·

Share on:

Detects creation of a file named "ntds.dit" (Active Directory Database)

NTDS.DIT Creation By Uncommon Parent Process

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·

Share on:

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory

NTDS.DIT Creation By Uncommon Process

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.003 ·

Share on:

Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory

Ntdsutil Abuse

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·

Share on:

Detects potential abuse of ntdsutil to dump ntds.dit database

Possible Impacket SecretDump Remote Activity

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.004 attack.t1003.003 ·

Share on:

Detect AD credential dumping using impacket secretdump HKTL

Possible Impacket SecretDump Remote Activity - Zeek

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.004 attack.t1003.003 ·

Share on:

Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml

Potential Russian APT Credential Theft Activity

Aug 12, 2024 · attack.credential-access attack.t1552.001 attack.t1003.003 detection.emerging-threats ·

Share on:

Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike

PUA - DIT Snapshot Viewer

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·

Share on:

Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.

Sensitive File Dump Via Wbadmin.EXE

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·

Share on:

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

Sensitive File Recovery From Backup Via Wbadmin.EXE

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·

Share on:

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.

Shadow Copies Creation Using Operating Systems Utilities

Aug 12, 2024 · attack.credential-access attack.t1003 attack.t1003.002 attack.t1003.003 ·

Share on:

Shadow Copies creation using operating systems utilities, possible credential access

Suspicious Active Directory Database Snapshot Via ADExplorer

Aug 12, 2024 · attack.credential-access attack.t1552.001 attack.t1003.003 ·

Share on:

Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database to a suspicious directory.

Suspicious Get-ADDBAccount Usage

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·

Share on:

Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get access to credentials without using any credential dumpers

Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)

Aug 12, 2024 · attack.credential-access attack.t1003.003 ·

Share on:

Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.

Transferring Files with Credential Data via Network Shares

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.001 attack.t1003.003 ·

Share on:

Transferring files with well-known filenames (sensitive files with credential data) using network shares

Transferring Files with Credential Data via Network Shares - Zeek

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.001 attack.t1003.003 ·

Share on:

Transferring files with well-known filenames (sensitive files with credential data) using network shares

VolumeShadowCopy Symlink Creation Via Mklink

Aug 12, 2024 · attack.credential-access attack.t1003.002 attack.t1003.003 ·

Share on:

Shadow Copies storage symbolic link creation using operating systems utilities

Secretsdump.py Execution

Mar 26, 2024 · attack.s0357 attack.credential_access attack.t1003 attack.t1003.003 attack.t1003.006 ·

Share on:

This detection analytic identifies Impacket’s secretsdump.py script on a target host, which is the most common script we have observed in customer environments. secretsdump.py is remotely run on an adversary’s machine to steal credentials. The command is commonly executed by svchost.exe, where regsvc.dll is loaded which allows the export of credentials from the registry. The output is redirected to an eight-character TMP file within the System32 directory. Part of the RedCanary 2024 Threat Detection Report.

Possible Impacket Secretsdump.py Activity

Sep 1, 2023 · attack.s0357 attack.credential_access attack.t1003 attack.t1003.003 attack.t1003.006 ·

Share on:

Detects attempts to retrieve/dump credentials using the DL_DRSGetNCChanges() method.

NTDSutil Pulling of NTDS.dit File

Nov 29, 2022 · attack.credential_access attack.t1003 attack.t1003.003 ·

Share on:

Detects use of the ntdsutil utility to pull ntds.dit (Active Directory database).