DC VMDK Accessed Offline via Hypervisor Datastore or Mounted on Windows Host
Detects unauthorized access to virtual hard disk (VMDK) files by non-standard processes followed by the creation or modification of sensitive offline credential artifacts such as ntds.dit or SYSTEM hives on the same host within a 2-hour window, indicating potential offline credential theft.
Microsoft Sentinel (KQL)
