From 830aea5f1179780458af5a861480967003ea6ce0 Mon Sep 17 00:00:00 2001 From: Ming Di Leom <2809763-curben@users.noreply.gitlab.com> Date: Sat, 9 Aug 2025 04:27:15 +0000 Subject: [PATCH] feat(ad-db-dump): detect ntds.dit dump using backup utility --- source/threat-hunting/ad-database-dump.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/source/threat-hunting/ad-database-dump.md b/source/threat-hunting/ad-database-dump.md index ab1801c..6aae654 100644 --- a/source/threat-hunting/ad-database-dump.md +++ b/source/threat-hunting/ad-database-dump.md @@ -2,13 +2,14 @@ title: AD Database Dump layout: page date: 2025-07-27 +updated: 2025-08-09 --- -References: [1](https://redcanary.com/blog/credential-access/), [2](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration) +References: [1](https://redcanary.com/blog/credential-access/), [2](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration), [3](https://thedfirreport.com/2025/08/05/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira/) SPL: ```spl -| tstats summariesonly=true allow_old_summaries=true count FROM datamodel=Endpoint.Processes WHERE index="windows" Processes.signature_id=4688 Processes.process="*ntds*" Processes.process IN ("*ifm create*", "*create full*", "*pro*") BY index, host, Processes.signature_id, Processes.signature, Processes.process, Processes.user, _time span=1s +| tstats summariesonly=true allow_old_summaries=true count FROM datamodel=Endpoint.Processes WHERE index="windows" Processes.signature_id=4688 Processes.process="*ntds*" Processes.process IN ("*ifm create*", "*create full*", "*pro*", "*backup*") BY index, host, Processes.signature_id, Processes.signature, Processes.process, Processes.user, _time span=1s | rename Processes.* AS *, signature_id AS EventCode, signature AS EventDescription | eval Time = strftime(_time, "%Y-%m-%d %H:%M:%S %z") | lookup ad_users sAMAccountName AS user OUTPUT displayName AS Name, mail AS Email