name: Ntdsutil Export NTDS
id: da63bc76-61ae-11eb-ae93-0242ac130002
version: 1
date: '2021-01-28'
author: Michael Haag, Patrick Bareiss, Splunk
type: batch
datamodel:
- Endpoint
description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory
  database - NTDS.dit, typically used for offline password cracking. It may be used
  in normal circumstances with no command line arguments or shorthand variations of
  more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical
  command used to dump ntds.dit \

  ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \

  This technique uses "Install from Media" (IFM), which will extract a copy of the
  Active Directory database. A successful export of the Active Directory database
  will yield a file modification named ntds.dit to the destination.'
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=ntdsutil.exe
  Processes.process=*ntds* Processes.process=*create*) by Processes.dest Processes.user
  Processes.parent_process Processes.process_name Processes.process Processes.process_id
  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)` | `ntdsutil_export_ntds_filter`'
how_to_implement: You must be ingesting endpoint data that tracks process activity,
  including parent-child relationships from your endpoints, to populate the Endpoint
  data model in the Processes node. The command-line arguments are mapped to the "process"
  field in the Endpoint data model.
known_false_positives: Highly possible Server Administrators will troubleshoot with
  ntdsutil.exe, generating false positives.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11)
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html
tags:
  analytic_story:
  - Credential Dumping
  - HAFNIUM Group
  asset_type: Endpoint
  automated_detection_testing: passed
  cis20:
  - CIS 8
  - CIS 16
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1003.003
  nist:
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.process_name
  - Processes.process
  - Processes.dest
  - Processes.user
  - Processes.parent_process
  - Processes.process_id
  - Processes.parent_process_id
  security_domain: endpoint
