This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.

« My First Alert Namespace Manipulation Using Unshare »

› › ›

NTDS or SAM Database File Copied

edit

NTDS or SAM Database File Copied

edit

Identifies a copy operation of the Active Directory Domain Database (ntds.dit) or Security Account Manager (SAM) files. Those files contain sensitive information including hashed domain and/or local credentials.

Rule type: eql

Rule indices:

winlogbeat-*
logs-endpoint.events.*
logs-windows.*
endgame-*

Severity: high

Risk score: 73

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 33

References:

Tags:

Elastic
Host
Windows
Threat Detection
Credential Access
Elastic Endgame

Version: 102 (version history)

Added (Elastic Stack release): 7.11.0

Last modified (Elastic Stack release): 8.6.0

Rule authors: Elastic, Austin Songer

Rule license: Elastic License v2

Investigation guide

edit

Rule query

edit

process where event.type == "start" and (
(process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE",
"XCOPY.EXE") and process.args : ("copy", "xcopy", "Copy-Item",
"move", "cp", "mv") ) or (process.pe.original_file_name :
"esentutl.exe" and process.args : ("*/y*", "*/vss*", "*/d*")) ) and
process.args : ("*\\ntds.dit", "*\\config\\SAM",
"\\*\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\*",
"*/system32/config/SAM*")

Threat mapping

edit

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Credential Access
- ID: TA0006
- Reference URL: https://attack.mitre.org/tactics/TA0006/
Technique:
- Name: OS Credential Dumping
- ID: T1003
- Reference URL: https://attack.mitre.org/techniques/T1003/

Rule version history

edit

Version 102 (8.6.0 release)

Formatting only

Version 101 (8.5.0 release)

Updated query, changed from:

process where event.type in ("start", "process_started") and (
(process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE",
"XCOPY.EXE") and process.args : ("copy", "xcopy", "Copy-Item",
"move", "cp", "mv") ) or (process.pe.original_file_name :
"esentutl.exe" and process.args : ("*/y*", "*/vss*", "*/d*")) ) and
process.args : ("*\\ntds.dit", "*\\config\\SAM",
"\\*\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\*",
"*/system32/config/SAM*")

Version 8 (8.4.0 release)

Formatting only

Version 6 (8.2.0 release)

Formatting only

Version 5 (7.16.0 release)

Formatting only

Version 4 (7.15.0 release)

Updated query, changed from:

process where event.type in ("start", "process_started") and
process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE",
"XCOPY.EXE") and process.args : ("copy", "xcopy", "Copy-Item",
"move", "cp", "mv") and process.args : ("*\\ntds.dit",
"*\\config\\SAM",
"\\*\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\*")

Version 3 (7.12.0 release)

Formatting only

Version 2 (7.11.2 release)

Formatting only

« My First Alert Namespace Manipulation Using Unshare »