Akira Campaign: NTDS.dit Extraction via wbadmin Backup on DC
Detects the unauthorized use of 'wbadmin.exe' to initiate a backup of Active Directory components (like 'ntds.dit' or the SYSTEM registry hive) when executed from common command-line interpreters (cmd.exe, powershell.exe). The rule correlates this backup activity with subsequent direct file access to sensitive AD database or registry files by processes other than standard system services (e.g., ntds.exe, lsass.exe), often indicative of credential dumping or exfiltration.
Microsoft Sentinel (KQL)
