name: Ntdsutil Export NTDS
id: da63bc76-61ae-11eb-ae93-0242ac130002
version: 1
date: '2021-01-28'
author: Michael Haag, Patrick Bareiss, Splunk
status: production
type: TTP
description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory
  database - NTDS.dit, typically used for offline password cracking. It may be used
  in normal circumstances with no command line arguments or shorthand variations of
  more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical
  command used to dump ntds.dit \

  ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \

  This technique uses "Install from Media" (IFM), which will extract a copy of the
  Active Directory database. A successful export of the Active Directory database
  will yield a file modification named ntds.dit to the destination.'
data_source:
- Sysmon Event ID 1
search:
  selection1:
    CommandLine: '*ntds*'
    Image|endswith: ntdsutil.exe
  selection2:
    CommandLine: '*create*'
  condition: (selection1 and selection2)
how_to_implement: You must be ingesting endpoint data that tracks process activity,
  including parent-child relationships from your endpoints, to populate the Endpoint
  data model in the Processes node. The command-line arguments are mapped to the "process"
  field in the Endpoint data model.
known_false_positives: Highly possible Server Administrators will troubleshoot with
  ntdsutil.exe, generating false positives.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11)
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html
- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
tags:
  analytic_story:
  - Credential Dumping
  - HAFNIUM Group
  - Living Off The Land
  - Prestige Ransomware
  - Ntdsutil Export NTDS
  asset_type: Endpoint
  confidence: 50
  impact: 100
  message: Active Directory NTDS export on $dest$
  mitre_attack_id:
  - T1003.003
  - T1003
  observable:
  - name: dest
    type: Endpoint
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 50
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
    sourcetype: xmlwineventlog