Query: detection rule: Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltrati
Matching passage: Sigma rule: Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltrati. Logsource: windows / file_event. Rule: title: NTDS Exfiltration Filename Patterns id: 3a8da4e0-36c1-40d2-8b29-b3e890d5172a status: test description: Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration. references: - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/post/windows/gather/ntds_grabber.rb - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/data/post/powershell/NTDSgrab.ps1 - https://github.com/SecureAuthCorp/impacket/blob/7d2991d78836b376452ca58b3d14daa61b67cb40/impacket/examples/secretsdump.py#L2405 author: Florian Roth (Nextron Systems) date: 2022-03-11 modified: 2023-05-05 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \All.cab - .ntds.cleartext condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects attempts to disable Windows EventLog autologger sessions via registry modification. The AutoLogger event tracing. Logsource: windows / process_creation. Rule: title: Windows EventLog Autologger Session Registry Modification Via CommandLine id: d7b81144-b866-48a4-9bcc-275dc69d870e related: - id: f37b4bce-49d0-4087-9f5b-58bffda77316 type: similar status: experimental description: 'Detects attempts to disable Windows EventLog autologger sessions via registry modification. The AutoLogger event tracing session records events that occur early in the operating system boot process. Applications and device drivers can use the AutoLogger session to capture traces before the user logs in. Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events. ' references: - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session - https://ptylu.github.io/content/report/report.html?report=25 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-25 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \reg.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - reg.exe - PowerShell.EXE - pwsh.dll selection_cli_action: CommandLine|contains: - 'add ' - Set-ItemProperty - New-ItemProperty - 'si ' selection_cli_base: CommandLine|contains: \Control\WMI\Autologger\ selection_cli_key: CommandLine|contains: - Start - Enabled condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_autologger_session_registry_modification/info.yml simulation: - type: atomic-red-team name: Disable EventLog-Application Auto Logger Session Via Registry - Cmd technique: T1562.001 atomic_guid: 653c6e17-14a2-4849-851d-f1c0cc8ea9ab - type: atomic-red-team name: Disable EventLog-Application Auto Logger Session Via Registry - PowerShell technique: T1562.001 atomic_guid: da86f239-9bd3-4e85-92ed-4a94ef111a1c - type: atomic-red-team name: Disable EventLog-Application ETW Provider Via Registry - Cmd technique: T1562.001 atomic_guid: 1cac9b54-810e-495c-8aac-989e0076583b - type: atomic-red-team name: Disable EventLog-Application ETW Provider Via Registry - PowerShell technique: T1562.001 atomic_guid: 8f907648-1ebf-4276-b0f0-e2678ca474f0