NTDS.DIT File Creation Detected

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•27

This rule detects the creation of a file named "ntds.dit", which is the Active Directory database. The NTDS.dit file contains critical information including user credentials (hashed passwords), group memberships, and other Active Directory objects. Adversaries often target this file to dump credentials for lateral movement and privilege escalation within a Windows domain.