NTDS.dit Database Dump Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•46

Detects potential abuse of ntdsutil or similar methods to dump the ntds.dit database. This activity is often associated with credential dumping from Active Directory.