Muddled Libra Suspected AD Database
Detects creation or presence of NTDS.dit and SYSTEM hive files in a user desktop context, consistent with reported domain controller disk mount and offline credential dumping activity.
Sigma
Detects creation or presence of NTDS.dit and SYSTEM hive files in a user desktop context, consistent with reported domain controller disk mount and offline credential dumping activity.
Already have an account?