Active Directory database file copied, exported or dumped

Siemphony@siemphonyhighT1003.003verified in lab

Matches a command line that names the Active Directory database or a tool that extracts it — ntds.dit itself, the NTDS directory on a domain controller, ntdsutil, whose install-from-media mode writes a full copy of the database, Invoke-NinjaCopy, which the technique names, and NTDSDumpEx, a closely related dumping utility added here. This is the only rule in the corpus keyed on the directory database: the neighbouring credential-dumping rules match handles opened against lsass.exe (T1003, T1003.001) or copies of the local SAM, SYSTEM and SECURITY hives (T1003.002, T1003.004), none of which touch a domain controller's NTDS. Shadow copy creation, which AN1611 also names, is deliberately not matched, because backup and imaging software creates shadow copies continuously and those hits would bury everything else. secretsdump.py, the other tool the technique names, has no selector either: its default DRSUAPI replication mode runs from a remote host against the domain controller's directory service and creates no process on the controller for this logsource to observe, so it is structurally out of scope here and only its local-file mode would match incidentally, through the ntds.dit term. The analytic's process source is Security EventID 4688, so Audit Process Creation must be enabled and, because every term here sits on the arguments, the separate Include command line in process creation events policy as well — with either one off this rule matches nothing while looking healthy. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0586, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "ntds.dit" or ProcessCommandLine contains "ntdsutil" or ProcessCommandLine contains "Windows\\NTDS" or ProcessCommandLine contains "Invoke-NinjaCopy" or ProcessCommandLine contains "NTDSDumpEx")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*ntds.dit*" OR CommandLine="*ntdsutil*" OR CommandLine="*Windows\\NTDS*" OR CommandLine="*Invoke-NinjaCopy*" OR CommandLine="*NTDSDumpEx*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*ntds.dit*" OR TO_LOWER(process.command_line) LIKE "*ntdsutil*" OR TO_LOWER(process.command_line) LIKE "*windows\\\\ntds*" OR TO_LOWER(process.command_line) LIKE "*invoke-ninjacopy*" OR TO_LOWER(process.command_line) LIKE "*ntdsdumpex*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(ntds\.dit|ntdsutil|Windows\\NTDS|Invoke-NinjaCopy|NTDSDumpEx)</field>    <description>Active Directory database file copied, exported or dumped</description>    <mitre>      <id>T1003.003</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: credential_dump
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 44618d2d-4365-4e90-a089-50cd102e9906

ATT&CKT1003.003

T1003.003NTDS

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessoncredential dump

credential dump

01 · What this rule detects

Attempts to read credential material out of memory or from disk — most commonly the LSASS process on Windows, or the SAM and SECURITY registry hives.

02 · Telemetry you need

Process access events including the target process and requested access mask (Sysmon Event ID 10 or equivalent EDR telemetry)
Process creation with full command lines
File creation events, to catch a dump written to disk
Registry save operations against the SAM, SYSTEM and SECURITY hives

03 · How the logic works

There are two families. The first matches process access where the target is lsass.exe and the granted access includes read-memory rights — this catches the technique rather than any particular tool. The second matches the tooling: command lines containing comsvcs.dll MiniDump, reg save of the credential hives, or known dumper names. Prefer the access-rights approach as the primary rule and keep the command-line matches as secondary coverage, because renaming a binary defeats the second but not the first.

04 · Common false positives

Endpoint protection and EDR agents legitimately reading LSASS
Crash and memory diagnostic tools, including Windows Error Reporting
Backup software reading registry hives during a system state backup
Performance monitoring agents enumerating process handles

05 · Detection maturity

Tier 1 — starting point: Matches known dumper tool names in the command line.
Tier 2 — tuned: Matches process access to LSASS with credential-relevant access rights, excluding signed security tooling by path.
Tier 3 — correlated: Adds the parent process chain and whether the accessing binary is signed and previously seen in the environment.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude by the full signed path of the accessing process, not its filename — filenames are trivially copied
Keep the access mask specific; a broad handle-open match will fire constantly
If your EDR already blocks this, the rule still has value as a record of attempts
Track which accounts perform the access — a service account is expected, an interactive user is not

Declared by the author

Domain controller promotion and demotion. The AD DS installation role writes and references the NTDS directory by path, and administrators build install-from-media sets with ntdsutil for a new or read-only controller, which is the same command an adversary uses to dump the database.
Scheduled offline maintenance of the directory database — compaction, integrity checks and semantic analysis are all run through ntdsutil and are routine domain controller housekeeping.
Backup, replication and disaster-recovery agents whose command lines name the NTDS path when they capture or restore system state on a domain controller. These recur on a fixed schedule under a service account, which is what MITRE's ParentProcessName knob is there to suppress.
Authorised red-team engagements and detection-validation suites, which run ntdsutil install-from-media and Invoke-NinjaCopy verbatim as part of a credential-access test.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — NTDS.dit extracted with ntdsutil
passed
Siemphony IR · 3 Sept 2026
2 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1003.003, evaluated against their process_creation events.

Share this rule

/u/siemphony/44618d2d-4365-4e90-a089-50cd102e9906

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Active Directory database file copied, exported or dumped

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it