name: Suspicious access to Active Directory domain database
id: a30c100e-28d0-4aa0-b98d-0d38025c2c29
version: 1.0.0
description: |
  Detects suspicious access to the Active Directory domain database.
  Adversaries may attempt to access or create a copy of the Active Directory
  domain database in order to steal credential information.
labels:
  tactic.id: TA0006
  tactic.name: Credential Access
  tactic.ref: https://attack.mitre.org/tactics/TA0006/
  technique.id: T1003
  technique.name: OS Credential Dumping
  technique.ref: https://attack.mitre.org/techniques/T1003/
  subtechnique.id: T1003.003
  subtechnique.name: NTDS
  subtechnique.ref: https://attack.mitre.org/techniques/T1003/003/

condition: >
  open_file
    and
  file.name imatches
    (
      '\\Device\\HarddiskVolumeShadowCopy*\\WINDOWS\\NTDS\\ntds.dit',
      '?:\\WINDOWS\\NTDS\\ntds.dit'
    )
    and
    not
  ps.exe imatches
    (
      '?:\\Windows\\System32\\lsass.exe',
      '?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe'
    )

min-engine-version: 2.0.0
