All Detections

NTDS theft

Azure Sentinel@AzureSentinel
updated Nov 4, 20253045

Microsoft has observed compromises related to Bazacall resulting in theft of the Active Directory database using ntdsutil.exe.

Microsoft Sentinel (KQL)