Suspicious Get-ADDBAccount Usage

Title: Suspicious Get-ADDBAccount Usage
Status: test
Description:Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get access to credentials without using any credential dumpers
References:
  -https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/
  -https://github.com/MichaelGrafnetter/DSInternals/blob/7ba59c12ee9a1cb430d7dc186a3366842dd612c8/Documentation/PowerShell/Get-ADDBAccount.md
Author: Florian Roth (Nextron Systems)
Date: 2022-03-16
modified:None
Tags:

• -'attack.credential-access'
• -'attack.t1003.003'

Logsource:

• product: windows
• category: ps_module
• definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b

Detection:
  selection:
    Payload|contains|all:
      -'Get-ADDBAccount'
      -'BootKey '
      -'DatabasePath '

  condition:selection
Falsepositives:
  -Unknown
Level: high