NTDS.dit File Access
This rule detects the creation or modification of the 'ntds.dit' file, which is the Active Directory database. This file contains critical information, including user credentials, and its access or exfiltration is a common objective for attackers attempting to gain control over a Windows domain. The rule specifically looks for Sysmon Event ID 11, which indicates file creation, and filters for events where the 'TargetFilename' ends with 'ntds.dit'. This activity is highly suspicious and often indicative of credential dumping or reconnaissance attempts against Active Directory.
Splunk (SPL)
