FTK Imager execution with correlated NTDS.dit/SAM/SYSTEM/SECURITY hive writes
Detects the execution of FTK Imager.exe followed by the creation of the Active Directory database (NTDS.dit) and at least one critical Windows registry hive file (SAM, SYSTEM, or SECURITY) in the user's Downloads folder within a 30-minute timeframe. This pattern is indicative of potential credential theft or offline password cracking attempts using forensic imaging utilities.
Microsoft Sentinel (KQL)
