Suspicious Access to VMware Virtual Disk File
Detects access to VMware virtual disk files (.vmdk). This technique was observed being used by the Muddled Libra (Scattered Spider) threat group, where they would power down Domain Controllers, mount their disks to a rogue VM, and steal the NTDS.dit and SYSTEM hives for offline credential extraction. This method bypasses security monitoring that would typically occur on the Domain Controller itself.
Sigma
