NTDS.dit or SYSTEM Hive Compression using Makecab

Ethan Andrews@eandrews

•updated Mar 16, 2026•7•0•179

This rule detects the use of the 'makecab.exe' utility to compress the Active Directory database (ntds.dit) or the SYSTEM registry hive. This is a technique used by attackers to prepare credentials and system secrets for exfiltration, as observed in intrusions following FortiGate compromises.