NTDS.DIT Created

Title: NTDS.DIT Created
Status: test
Description:Detects creation of a file named "ntds.dit" (Active Directory Database)
References:
  -Internal Research
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-05
modified:None
Tags:

• -'attack.credential-access'
• -'attack.t1003.003'

Logsource:

• product: windows
• category: file_event

Detection:
  selection:
    TargetFilename|endswith: 'ntds.dit'
  condition:selection
Falsepositives:
  -Unknown
Level: low