NTDS Exfiltration Filename Patterns

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•29

Detects the creation of files with specific name patterns that are commonly used by tools like Metasploit and Impacket's secretsdump.py to export and stage the NTDS.DIT database for exfiltration. These patterns include '.ntds.cleartext' and 'All.cab', which are indicative of attempts to dump Active Directory credentials.