Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects the execution of 'ntdsutil.exe', a Windows command-line tool that can be used to perform various operations on the Active Directory database (NTDS.DIT). Adversaries may use this tool to extract credential information or other sensitive data from the NTDS.DIT file.