NTDS.DIT Creation By Uncommon Process or Suspicious Path
Detects the creation of an 'ntds.dit' file, which contains Active Directory database information including credential hashes, by processes commonly abused by attackers or processes running from suspicious directories like 'Temp' or 'AppData'. This activity is highly indicative of credential dumping attempts.
Sigma
