Query: alert when Detects suspicious process patterns used in NTDS.DIT exfiltration
Matching passage: Sigma rule: Detects suspicious process patterns used in NTDS.DIT exfiltration. Logsource: windows / process_creation. Rule: title: Suspicious Process Patterns NTDS.DIT Exfil id: 8bc64091-6875-4881-aaf9-7bd25b5dda08 status: test description: Detects suspicious process patterns used in NTDS.DIT exfiltration references: - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/ - https://pentestlab.blog/tag/ntds-dit/ - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1 - https://github.com/zcgonvh/NTDSDumpEx - https://github.com/rapid7/metasploit-framework/blob/d297adcebb5c1df6fe30b12ca79b161deb71571c/data/post/powershell/NTDSgrab.ps1 - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1 author: Florian Roth (Nextron Systems) date: 2022-03-11 modified: 2022-11-10 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: process_creation detection: selection_tool: - Image|endswith: - \NTDSDump.exe - \NTDSDumpEx.exe - CommandLine|contains|all: - ntds.dit - system.hiv - CommandLine|contains: NTDSgrab.ps1 selection_oneliner_1: CommandLine|contains|all: - ac i ntds - create full selection_onliner_2: CommandLine|contains|all: - '/c copy ' - \windows\ntds\ntds.dit selection_onliner_3: CommandLine|contains|all: - activate instance ntds - create full selection_powershell: CommandLine|contains|all: - powershell - ntds.dit set1_selection_ntds_dit: CommandLine|contains: ntds.dit set1_selection_image_folder: - ParentImage|contains: - \apache - \tomcat - \AppData\ - \Temp\ - \Public\ - \PerfLogs\ - Image|contains: - \apache - \tomcat - \AppData\ - \Temp\ - \Public\ - \PerfLogs\ condition: 1 of selection* or all of set1* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to pers. Logsource: windows / bits-client. Rule: title: BITS Transfer Job With Uncommon Or Suspicious Remote TLD id: 6d44fb93-e7d2-475c-9d3d-54c9c1e33427 status: test description: Detects a suspicious download using the BITS client from a FQDN that is unusual. Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md - https://twitter.com/malmoeb/status/1535142803075960832 author: Florian Roth (Nextron Systems) date: 2022-06-10 modified: 2025-02-28 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 logsource: product: windows service: bits-client detection: selection: EventID: 16403 filter_main_generic: RemoteName|contains: - .azureedge.net/ - .com/ - .sfx.ms/ - download.mozilla.org/ - cdn.onenote.net/ - cdn.office.net/ - tscdn.m365.static.microsoft/ condition: selection and not 1 of filter_main_* falsepositives: - This rule doesn't exclude other known TLDs such as ".org" or ".net". It's recommended to apply additional filters for software and scripts that leverage the BITS service level: medium