PUA - DIT Snapshot Viewer

Title: PUA - DIT Snapshot Viewer
Status: test
Description:Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.
References:
  -https://thedfirreport.com/2020/06/21/snatch-ransomware/
  -https://web.archive.org/web/20201124182207/https://github.com/yosqueoy/ditsnap
Author: Furkan Caliskan (@caliskanfurkan_)
Date: 2020-07-04
modified:2023-02-21
Tags:

• -'attack.credential-access'
• -'attack.t1003.003'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Image|endswith:'\ditsnap.exe' CommandLine|contains:'ditsnap.exe'   condition:selection
Falsepositives:
  -Legitimate admin usage
Level: high