ntdsutil IFM NTDS.dit dump following RDP logon on same host
Detects the execution of ntdsutil.exe with arguments to create an Install from Media (IFM) database backup, preceded shortly by a Remote Interactive logon (RDP) from a remote IP source, which can indicate adversary activity attempting to dump Active Directory credentials.
Microsoft Sentinel (KQL)
