NTDS theft

Description

Microsoft has observed compromises related to Bazacall resulting in theft of the Active Directory database using ntdsutil.exe.

Query · kql

DeviceProcessEvents
| where FileName =~ "ntdsutil.exe"
| where ProcessCommandLine has_any("full", "fu")
| where ProcessCommandLine has_any ("temp", "perflogs", "programdata")
// Exclusion
| where ProcessCommandLine !contains @"Backup"
Raw source NTDS theft · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 2a03d94e-991b-44f7-a2b3-e12ce6fd6c57
name: NTDS theft
description: |
  Microsoft has observed compromises related to Bazacall resulting in theft of the Active Directory database using ntdsutil.exe.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Credential Access
- Exfiltration
query: |
  DeviceProcessEvents
  | where FileName =~ "ntdsutil.exe"
  | where ProcessCommandLine has_any("full", "fu")
  | where ProcessCommandLine has_any ("temp", "perflogs", "programdata")
  // Exclusion
  | where ProcessCommandLine !contains @"Backup"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.