NTDS.dit File Modification
This rule detects modifications to the NTDS.dit file, which is the Active Directory database. Adversaries often target this file to extract credentials and other sensitive information from domain controllers. Monitoring changes to this file can indicate an attempt at credential dumping or unauthorized access to Active Directory.
Microsoft Sentinel (KQL)
