このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
Goal
Detect when ntdsutil is used in a suspicious manner, typically to access the ntds.dit file
Strategy
Threat actors are known to utilize tools found natively in a victim’s environment to accomplish their objectives. Ntdsutil, a legitimate Windows binary, has been abused by malicious actors in the past to gain access to the ntds.dit file.
Triage and response
- Identify if the usage of ntdsutil is authorized, and confirm if the ntds.dit file was downloaded.
- If it’s not authorized, isolate the host from the network.
- Follow your organization’s internal processes for investigating and remediating compromised systems.
Requires Agent version 7.50.0 or greater.
This rule is a part of the beta for detections on Windows! If you would like to try the new Windows agent, create a support ticket and indicate that you wish to join the Cloud Security Management - Windows beta.
