Active Directory Dumping via NTDSUtil

Hypothesis and description

The NTDSUtil tool may be used to dump a Microsoft Active Directory database to disk for processing with a credential access tool such as Mimikatz. This is performed by launching ntdsutil.exe as a privileged user with command line arguments indicating that media should be created for offline Active Directory installation and specifying a folder path. This process will create a copy of the Active Directory database, ntds.dit, to the specified folder path.

This requires filesystem data to determine whether files have been created.

Platforms: Windows
Domain: Host
Subtypes: File
Submitted: 2019-08-13
Contributors: Tony Lambert/Red Canary

ATT&CK coverage

Technique	Tactics	Coverage
T1003 OS Credential DumpingT1003.003	Credential Access	Low

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1003OS Credential Dumping
.003 NTDS

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodeNTDSUtil - File Create

This base pseudocode looks for file create events where a file with a name of ntds.dit is created by the ntdsutil process.

files = search File:Create
ntds_dump = filter files where (
  file_name = "ntds.dit"  and
  image_path = "*ntdsutil.exe")
output ntds_dump

SplunkNTDSUtil - File CreateData model: Sysmon native

A Splunk/Sysmon version of the above pseudocode.

index=__your_sysmon_index__ EventCode=11 TargetFilename="*ntds.dit" Image="*ntdsutil.exe"

EQLNTDSUtil - File CreateData model: EQL native

An EQL version of the above pseudocode.

file where file_name == "ntds.dit" and process_name == "ntdsutil.exe"

LogPointData model: LogPoint native

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=11 file="*ntds.dit" source_image="*ntdsutil.exe"

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

36 more in the full list

View CAR-2019-08-002 on car.mitre.org

Hypothesis and description

This requires filesystem data to determine whether files have been created.

Technique

Tactics

Coverage

T1003 OS Credential DumpingT1003.003

Credential Access

Low