| splunk |
Creation of Shadow Copy with wmic and powershell |
production |
2026-10-09 |
| splunk |
Credential Dumping via Symlink to Shadow Copy |
production |
2026-10-09 |
| splunk |
Credential Dumping via Copy Command from Shadow Copy |
production |
2026-10-09 |
| splunk |
Creation of Shadow Copy |
production |
2026-10-09 |
| splunk |
Ntdsutil Export NTDS |
production |
2026-10-02 |
| elastic |
Creation or Modification of Domain Backup DPAPI private key |
production |
2026-09-18 |
| elastic |
Potential Credential Access via Windows Utilities |
production |
2026-09-18 |
| elastic |
NTDS Dump via Wbadmin |
production |
2026-09-18 |
| elastic |
Symbolic Link to Shadow Copy Created |
production |
2026-09-18 |
| elastic |
PowerShell Invoke-NinjaCopy script |
production |
2026-09-18 |
| elastic |
NTDS or SAM Database File Copied |
production |
2026-09-18 |
| splunk |
SecretDumps Offline NTDS Dumping Tool |
production |
2026-05-13 |
| sigma |
Sensitive File Dump Via Print.EXE |
test |
2026-04-28 |
| sigma |
Cred Dump Tools Dropped Files |
test |
2025-10-25 |
| sigma |
Transferring Files with Credential Data via Network Shares |
test |
2025-07-11 |
| sigma |
Copying Sensitive Files with Credential Data |
test |
2024-06-04 |
| sigma |
Sensitive File Dump Via Wbadmin.EXE |
test |
2024-05-10 |
| sigma |
Sensitive File Recovery From Backup Via Wbadmin.EXE |
test |
2024-05-10 |
| sigma |
NTDS Exfiltration Filename Patterns |
test |
2023-05-05 |
| sigma |
NTDS.DIT Created |
test |
2023-05-05 |
| sigma |
Potential Russian APT Credential Theft Activity |
stable |
2023-03-08 |
| sigma |
VolumeShadowCopy Symlink Creation Via Mklink |
stable |
2023-03-06 |
| sigma |
PUA - DIT Snapshot Viewer |
test |
2023-02-21 |
| sigma |
NTDS.DIT Creation By Uncommon Parent Process |
test |
2023-01-05 |
| sigma |
Shadow Copies Creation Using Operating Systems Utilities |
test |
2022-11-10 |
| sigma |
Suspicious Process Patterns NTDS.DIT Exfil |
test |
2022-11-10 |
| sigma |
Esentutl Gather Credentials |
test |
2022-10-09 |
| sigma |
Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe) |
test |
2022-09-14 |
| sigma |
Ntdsutil Abuse |
test |
2022-08-14 |
| sigma |
Possible Impacket SecretDump Remote Activity |
test |
2022-08-11 |
| sigma |
NTDS.DIT Creation By Uncommon Process |
test |
2022-07-14 |
| sigma |
Suspicious Get-ADDBAccount Usage |
test |
2022-03-16 |
| sigma |
Invocation of Active Directory Diagnostic Tool (ntdsutil.exe) |
test |
2022-03-11 |
| sigma |
Create Volume Shadow Copy with Powershell |
test |
2022-01-12 |
| sigma |
Possible Impacket SecretDump Remote Activity - Zeek |
test |
2021-11-27 |
| sigma |
Transferring Files with Credential Data via Network Shares - Zeek |
test |
2021-11-27 |