Sensitive File Dump Via Wbadmin.EXE

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•0•12

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive using the `wbadmin.exe` utility. Attackers can leverage `wbadmin` to dump sensitive files that might contain credentials or other sensitive information.