Sensitive File Dump Via Wbadmin.EXE

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•0•0•0

Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive. Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.