Active Directory database file copied, exported or dumped

1title: Active Directory database file copied, exported or dumped2id: 44618d2d-4365-4e90-a089-50cd102e99063status: experimental4description: |5  Matches a command line that names the Active Directory database or a tool that6  extracts it — ntds.dit itself, the NTDS directory on a domain controller,7  ntdsutil, whose install-from-media mode writes a full copy of the database,8  Invoke-NinjaCopy, which the technique names, and NTDSDumpEx, a closely related9  dumping utility added here. This is the only rule in the corpus10  keyed on the directory database: the neighbouring credential-dumping rules match11  handles opened against lsass.exe (T1003, T1003.001) or copies of the local SAM,12  SYSTEM and SECURITY hives (T1003.002, T1003.004), none of which touch a domain13  controller's NTDS. Shadow copy creation, which AN1611 also names, is deliberately14  not matched, because backup and imaging software creates shadow copies15  continuously and those hits would bury everything else. secretsdump.py, the16  other tool the technique names, has no selector either: its default DRSUAPI17  replication mode runs from a remote host against the domain controller's18  directory service and creates no process on the controller for this logsource to19  observe, so it is structurally out of scope here and only its local-file mode20  would match incidentally, through the ntds.dit term. The analytic's process21  source is Security EventID 4688, so Audit Process Creation must be enabled and,22  because every term here sits on the arguments, the separate Include command line23  in process creation events policy as well — with either one off this rule matches24  nothing while looking healthy.25  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0586, not hand-written and not tested by its author. Any lab result is on this rule's own page.26references:27  - https://attack.mitre.org/techniques/T1003/00328  - https://attack.mitre.org/detectionstrategies/DET058629author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)30date: 2026-08-1631tags:32  - attack.credential-access33  - attack.t1003.00334logsource:35  category: process_creation36  product: windows37detection:38  selection:39    CommandLine|contains:40      - 'ntds.dit'41      - 'ntdsutil'42      - 'Windows\NTDS'43      - 'Invoke-NinjaCopy'44      - 'NTDSDumpEx'45  condition: selection46falsepositives:47  - "Domain controller promotion and demotion. The AD DS installation role writes and references the NTDS directory by path, and administrators build install-from-media sets with ntdsutil for a new or read-only controller, which is the same command an adversary uses to dump the database."48  - "Scheduled offline maintenance of the directory database — compaction, integrity checks and semantic analysis are all run through ntdsutil and are routine domain controller housekeeping."49  - "Backup, replication and disaster-recovery agents whose command lines name the NTDS path when they capture or restore system state on a domain controller. These recur on a fixed schedule under a service account, which is what MITRE's ParentProcessName knob is there to suppress."50  - "Authorised red-team engagements and detection-validation suites, which run ntdsutil install-from-media and Invoke-NinjaCopy verbatim as part of a credential-access test."51level: high