Dump Ntds.dit To Suspicious Location

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

This rule detects attempts to dump the NTDS.dit database to suspicious locations. It specifically looks for ESENT event ID 325 (New Database Created) where the data contains 'ntds.dit' and the path includes common suspicious directories such as Appdata, Desktop, Downloads, Perflogs, Temp, or Users\Public.