Mock Take-Home — T1003.003 NTDS.dit Credential Theft

This is a full mock take-home challenge. The time limit is 72 hours. Write your answer before reading the model solution.

Model Solution

1. Detection Rationale

Technique: T1003.003 — OS Credential Dumping: NTDS.dit

Behavioral invariant: Any extraction of NTDS.dit requires one of three OS-level operations:

Creating a Volume Shadow Copy to access the locked database file (vssadmin / WMIC WMI call)
Invoking ntdsutil.exe with IFM parameters to export the database
Opening a read handle to the ntds.dit file directly (rarest in practice)

I will cover extraction paths 1 and 2 with separate rules. Path 3 (direct file handle) is included as a bonus rule, noting the lower signal-to-noise ratio.

DML level: DML-4 to DML-5. The rules target specific host artifacts (ntdsutil arguments, shadow copy creation on DCs) rather than generic OS primitives — because the behavioral invariant for ntds.dit extraction IS relatively specific to these tools. A DML-6 complement (any file read of ntds.dit path) is also provided.

Telemetry required:

Sysmon Event 1 (Process Creation) — required for all three primary rules
Sysmon Event 11 (File Created) — required for the bonus file access rule
Windows Security Event 7045 (New Service) — optional complement for shadow copy creation

2. Detection Rules

Rule 1: NTDSUtil IFM Command Execution

title: NTDSUtil IFM Command — NTDS.dit Extraction
id: b2c3d4e5-f6a7-8901-bcde-f123456789ab
status: stable
description: |
  Detects ntdsutil.exe invoked with 'ifm' or 'install from media' arguments,
  indicating NTDS.dit export. This command is used by attackers to extract
  a copy of the Active Directory database. Legitimate use: domain controller
  provisioning via IFM, which should be rare and documented.
references:
  - https://attack.mitre.org/techniques/T1003/003/
tags:
  - attack.credential_access
  - attack.t1003.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\ntdsutil.exe'
    CommandLine|contains|all:
      - 'ifm'
      - 'create'
  condition: selection
falsepositives:
  - Legitimate domain controller provisioning via IFM (Install From Media)
    during planned DC deployment — expected frequency: < 4 times/year per DC
level: high
fields:
  - Image
  - CommandLine
  - User
  - ParentImage
  - ComputerName

Rule 2: VSS Shadow Copy Creation on Domain Controller

title: Volume Shadow Copy Created on Domain Controller — NTDS.dit Theft Precursor
id: c3d4e5f6-a7b8-9012-cdef-123456789abc
status: experimental
description: |
  Detects vssadmin or wmic creating volume shadow copies on Windows hosts.
  Combined with the host being a domain controller, this is a high-confidence
  NTDS.dit theft precursor — attackers create shadow copies to access the
  locked ntds.dit file.
tags:
  - attack.credential_access
  - attack.t1003.003
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'create shadow'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains:
      - 'shadowcopy'
      - 'create'
  condition: 1 of selection_*
falsepositives:
  - Backup software that uses VSS for consistent backups (Veeam, Windows Server Backup)
    — filter by ParentImage matching known backup tool paths
  - System-triggered VSS during Windows Updates (ParentImage: TrustedInstaller.exe)
level: medium
fields:
  - Image
  - CommandLine
  - ParentImage
  - ComputerName

Rule 3 (Bonus): NTDS.dit File Access

title: NTDS.dit File Accessed Outside Expected Paths
id: d4e5f6a7-b8c9-0123-defa-23456789abcd
status: experimental
description: |
  Detects file creation or access events for files named ntds.dit outside
  the expected NTDS database path, indicating the file may have been copied
  for offline extraction.
tags:
  - attack.credential_access
  - attack.t1003.003
logsource:
  category: file_event
  product: windows
detection:
  selection:
    FileName|endswith: '\ntds.dit'
  filter_legitimate_path:
    FileName|startswith: 'C:\Windows\NTDS\'
  condition: selection and not filter_legitimate_path
falsepositives:
  - AD Lightweight Directory Services (NTDS.dit can exist in non-standard paths)
  - Backup software that restores NTDS.dit to a temporary path during AD recovery
level: high
fields:
  - Image
  - FileName
  - User
  - ComputerName

3. Test Fixtures

TP Fixture — Rule 1 (NTDSUtil):

[{
  "EventID": 1,
  "Image": "C:\\Windows\\System32\\ntdsutil.exe",
  "CommandLine": "ntdsutil.exe \"ac i ntds\" \"ifm\" \"create full c:\\temp\\ifm\" q q",
  "ParentImage": "C:\\Windows\\System32\\cmd.exe",
  "User": "CORP\\Administrator",
  "ComputerName": "dc01",
  "_source": "Atomic Red Team T1003.003 test 1 — NTDSUtil IFM"
}]

TP Fixture — Rule 2 (VSS):

[{
  "EventID": 1,
  "Image": "C:\\Windows\\System32\\vssadmin.exe",
  "CommandLine": "vssadmin.exe create shadow /for=C:",
  "ParentImage": "C:\\Windows\\System32\\cmd.exe",
  "User": "CORP\\Administrator",
  "ComputerName": "dc01",
  "_source": "Atomic Red Team T1003.003 test 2 — VSS shadow copy creation"
}]

FP Fixture — Rule 2 (Backup Software):

[{
  "EventID": 1,
  "Image": "C:\\Windows\\System32\\vssadmin.exe",
  "CommandLine": "vssadmin create shadow /for=C:",
  "ParentImage": "C:\\Program Files\\Veeam\\Backup and Replication\\Veeam.Backup.Agent.exe",
  "User": "CORP\\svc-veeam",
  "ComputerName": "fileserver01",
  "_source": "Synthetic — known-legitimate Veeam backup VSS creation; excluded via ParentImage filter"
}]

4. Limitations

Rule 1 (NTDSUtil):

Catches IFM-based extraction only. Does not cover DCSync (T1003.006) — separate rule needed.
The FP rate should be very low on domain controllers (IFM provisioning is rare and documented). On non-DC hosts, FP rate approaches zero — ntdsutil.exe for IFM only runs on DCs.
Higher-DML complement: Event 4662 (Directory Service Access) on DCs for DCSync — targets replication rights being used by non-DC accounts.

Rule 2 (VSS):

Medium FP rate due to backup software. Should be tuned with ParentImage exclusions for known backup tools.
Does not distinguish between shadow copy creation for NTDS theft vs. ransomware (T1490) — consider tagging with both ATT&CK techniques.
Adding host context (is this host a domain controller?) would increase signal quality significantly.

Rule 3 (File Access):

Sysmon Event 11 (FileCreate) captures file creation, not file reads. The ntds.dit file is locked while AD is running — attackers typically read from a shadow copy rather than the live file. This rule catches the exported copy, not the original access.
FP risk from AD recovery operations is real — coordinate with AD team on known restoration events.

What this doesn’t cover:

DCSync (T1003.006): replication-based extraction via LDAP — requires separate Event 4662 rule.
Backup software that natively backs up ntds.dit via VSS without invoking vssadmin.exe — this leaves no process creation artifact.

T1003.003 — NTDS.dit— MITRE Atomic Red Team T1003.003— Red Canary

Retrieval Practice

After submitting your mock take-home, the interviewer says: 'Your Rule 2 (VSS creation) will fire on every Windows Server Backup job on all production servers. How do you reduce FPs without losing coverage of the actual NTDS.dit theft scenario?' Give a specific answer.

Reveal answer

Three targeted refinements: (1) Add host context filtering — DC-specific alert: 'If this event fires on a domain controller, level: high, no filtering.' Non-DC servers running VSS for backups are lower risk for NTDS.dit theft. Implement as separate rule: if ComputerName matches DC naming convention AND vssadmin create shadow → immediate escalation. (2) ParentImage exclusion for known backup tools: add filter_backup_software with ParentImage containing known paths (Veeam, Windows Server Backup, Commvault, Cohesity). This is safe to exclude because backup software invokes vssadmin with a documented service account. Document the exclusion and list all excluded backup tool paths explicitly — future engineers need to understand why the exclusion exists. (3) User context: service account vs. interactive session. Backup VSS creation runs as a service account (CORP\\svc-backup). An interactive admin session creating a shadow copy at 2am is high-confidence attacker behavior. Add condition: NOT (User|startswith 'svc-') OR time is outside business hours. After these three refinements, the rule fires at high confidence for: domain controllers regardless of source, non-DC hosts where the VSS creation comes from an interactive admin session outside known backup windows. The residual FP rate should be manageable — < 5 per week for investigation.