Suspicious Process Patterns NTDS.DIT Exfil

Title: Suspicious Process Patterns NTDS.DIT Exfil
Status: test
Description:Detects suspicious process patterns used in NTDS.DIT exfiltration
References:
  -https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
  -https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/
  -https://pentestlab.blog/tag/ntds-dit/
  -https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1
  -https://github.com/zcgonvh/NTDSDumpEx
  -https://github.com/rapid7/metasploit-framework/blob/d297adcebb5c1df6fe30b12ca79b161deb71571c/data/post/powershell/NTDSgrab.ps1
  -https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1
Author: Florian Roth (Nextron Systems)
Date: 2022-03-11
modified:2022-11-10
Tags:

• -'attack.credential-access'
• -'attack.t1003.003'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_tool:
    - Image|endswith:
      - '\NTDSDump.exe'
      - '\NTDSDumpEx.exe'
    - CommandLine|contains|all:
      - 'ntds.dit'
      - 'system.hiv'
CommandLine|contains:'NTDSgrab.ps1'   selection_oneliner_1:
    CommandLine|contains|all:
      -'ac i ntds'
      -'create full'

  selection_onliner_2:
    CommandLine|contains|all:
      -'/c copy '
      -'\windows\ntds\ntds.dit'

  selection_onliner_3:
    CommandLine|contains|all:
      -'activate instance ntds'
      -'create full'

  selection_powershell:
    CommandLine|contains|all:
      -'powershell'
      -'ntds.dit'

  set1_selection_ntds_dit:
    CommandLine|contains: 'ntds.dit'
  set1_selection_image_folder:
    - ParentImage|contains:
      - '\apache'
      - '\tomcat'
      - '\AppData\'
      - '\Temp\'
      - '\Public\'
      - '\PerfLogs\'
    - Image|contains:
      - '\apache'
      - '\tomcat'
      - '\AppData\'
      - '\Temp\'
      - '\Public\'
      - '\PerfLogs\'
  condition:1 of selection* or all of set1*
Falsepositives:
  -Unknown
Level: high