SigmaHQ/rules/windows/deprecated/win_susp_vssadmin_ntds_activity.yml

title: Activity Related to NTDS.dit Domain Hash Retrieval
id: b932b60f-fdda-4d53-8eda-a170c1d97bbd
status: experimental
description: Detects suspicious commands that could be related to activity that uses volume shadow copy to steal and retrieve hashes from the NTDS.dit file remotely
author: Florian Roth, Michael Haag
date: 2019/01/16
references:
    - https://www.swordshield.com/2015/07/getting-hashes-from-ntds-dit-file/
    - https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/
    - https://www.trustwave.com/Resources/SpiderLabs-Blog/Tutorial-for-NTDS-goodness-(VSSADMIN,-WMIS,-NTDS-dit,-SYSTEM)/
    - https://securingtomorrow.mcafee.com/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/
    - https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/
tags:
    - attack.credential_access
    - attack.t1003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine:
            - vssadmin.exe Delete Shadows
            - 'vssadmin create shadow /for=C:'
            - copy \\?\GLOBALROOT\Device\\*\windows\ntds\ntds.dit
            - copy \\?\GLOBALROOT\Device\\*\config\SAM
            - 'vssadmin delete shadows /for=C:'
            - 'reg SAVE HKLM\SYSTEM '
            - esentutl.exe /y /vss *\ntds.dit*
            - esentutl.exe /y /vss *\SAM
            - esentutl.exe /y /vss *\SYSTEM
    condition: selection
fields:
    - CommandLine
    - ParentCommandLine
falsepositives:
    - Administrative activity
level: high
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`title: Activity Related to NTDS.dit Domain Hash Retrieval`
Added UUIDs to rules 2019-11-12 22:12:27 +00:00			`id: b932b60f-fdda-4d53-8eda-a170c1d97bbd`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`status: experimental`
			`description: Detects suspicious commands that could be related to activity that uses volume shadow copy to steal and retrieve hashes from the NTDS.dit file remotely`
Small edits Got trigger happy, first time doing this, please dont cruicify me. 2019-05-17 14:40:32 +00:00			`author: Florian Roth, Michael Haag`
fix: fixed missing date fields in remaining files 2020-01-30 15:07:37 +00:00			`date: 2019/01/16`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`references:`
Increased indentation to 4 * Converted (to generic sigma) rules * Converter outputs by default with indentation 4 2019-03-01 23:14:20 +00:00			`- https://www.swordshield.com/2015/07/getting-hashes-from-ntds-dit-file/`
			`- https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/`
			`- https://www.trustwave.com/Resources/SpiderLabs-Blog/Tutorial-for-NTDS-goodness-(VSSADMIN,-WMIS,-NTDS-dit,-SYSTEM)/`
			`- https://securingtomorrow.mcafee.com/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/`
			`- https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/`
Merge branch 'master' into project-1 2019-02-25 23:24:46 +00:00			`tags:`
Increased indentation to 4 * Converted (to generic sigma) rules * Converter outputs by default with indentation 4 2019-03-01 23:14:20 +00:00			`- attack.credential_access`
			`- attack.t1003`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`logsource:`
Increased indentation to 4 * Converted (to generic sigma) rules * Converter outputs by default with indentation 4 2019-03-01 23:14:20 +00:00			`category: process_creation`
			`product: windows`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`detection:`
Increased indentation to 4 * Converted (to generic sigma) rules * Converter outputs by default with indentation 4 2019-03-01 23:14:20 +00:00			`selection:`
			`CommandLine:`
			`- vssadmin.exe Delete Shadows`
			`- 'vssadmin create shadow /for=C:'`
			`- copy \\?\GLOBALROOT\Device\\*\windows\ntds\ntds.dit`
			`- copy \\?\GLOBALROOT\Device\\*\config\SAM`
			`- 'vssadmin delete shadows /for=C:'`
			`- 'reg SAVE HKLM\SYSTEM '`
			`- esentutl.exe /y /vss \ntds.dit`
Update win_susp_vssadmin_ntds_activity.yml Updated with SAM and SYSTEM for esentutl 2019-05-17 12:18:01 +00:00			`- esentutl.exe /y /vss *\SAM`
			`- esentutl.exe /y /vss *\SYSTEM`
Increased indentation to 4 * Converted (to generic sigma) rules * Converter outputs by default with indentation 4 2019-03-01 23:14:20 +00:00			`condition: selection`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`fields:`
Increased indentation to 4 * Converted (to generic sigma) rules * Converter outputs by default with indentation 4 2019-03-01 23:14:20 +00:00			`- CommandLine`
			`- ParentCommandLine`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`falsepositives:`
Increased indentation to 4 * Converted (to generic sigma) rules * Converter outputs by default with indentation 4 2019-03-01 23:14:20 +00:00			`- Administrative activity`
Converted Sysmon/1 and Security/4688 to generic process creation rules 2019-01-16 22:36:31 +00:00			`level: high`