Detect NTDS in Google Chronicle

rule ntds_credential_dumping {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects NTDS.dit credential extraction via ntdsutil IFM, VSS copy, esentutl, secretsdump, DCSync, and Invoke-NinjaCopy on domain controllers"
    mitre_attack = "T1003.003"
    severity = "CRITICAL"
    priority = "HIGH"
    created = "2026-04-13"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.hostname = $hostname

    (
      (
        re.regex($e.target.process.file.full_path, `(?i)ntdsutil\.exe`) and
        (
          re.regex($e.target.process.command_line, `(?i)(ifm|install\s+from\s+media|create\s+full|ac\s+i\s+ntds|activate\s+instance\s+ntds)`) or
          re.regex($e.target.process.command_line, `(?i)ntds\.dit`)
        )
      ) or
      re.regex($e.target.process.command_line, `(?i)(secretsdump|drsuapi|dcsync|ninja.?copy)`) or
      (
        re.regex($e.target.process.file.full_path, `(?i)esentutl\.exe`) and
        re.regex($e.target.process.command_line, `(?i)(ntds|\.dit|shadow)`)
      ) or
      (
        re.regex($e.target.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|vssadmin\.exe|robocopy\.exe|xcopy\.exe)`) and
        re.regex($e.target.process.command_line, `(?i)ntds`) and
        re.regex($e.target.process.command_line, `(?i)(shadow|dit)`)
      )
    )

  condition:
    $e
}